diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index ce31d2d3..1aefe330 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   benchmark:
     name: Performance regression check
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     env:
       CS_ZEROKMS_HOST: https://us-east-1.aws.zerokms.cipherstashmanaged.net
       CS_CTS_HOST: https://ap-southeast-2.aws.cts.cipherstashmanaged.net
@@ -46,6 +46,12 @@ jobs:
           CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
           CS_WORKSPACE_CRN: ${{ secrets.CS_VAULT_WORKSPACE_CRN }}
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_HUB_USERNAME }}
+          password: ${{ env.DOCKER_HUB_PASSWORD }}
+
       - run: |
           mise run postgres:up --extra-args "--detach --wait"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6760ad77..223f7dec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -52,7 +52,7 @@ jobs:
       fail-fast: false
       matrix:
         build:
-          - { os: blacksmith-16vcpu-ubuntu-2404, docker_platform: linux/amd64, rust_target: "x86_64-unknown-linux-gnu" }
+          - { os: "runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache", docker_platform: linux/amd64, rust_target: "x86_64-unknown-linux-gnu" }
           - { os: linux-arm64-public,            docker_platform: linux/arm64, rust_target: "aarch64-unknown-linux-gnu" }
     env:
       CS_ZEROKMS_HOST: https://us-east-1.aws.zerokms.cipherstashmanaged.net
@@ -73,6 +73,13 @@ jobs:
           CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
           CS_WORKSPACE_CRN: ${{ secrets.CS_VAULT_WORKSPACE_CRN }}
 
+      # Log in before `mise run build`. It pulls the image's base from Docker Hub.
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_HUB_USERNAME }}
+          password: ${{ env.DOCKER_HUB_PASSWORD }}
+
       - name: Setup Rust cache
         uses: Swatinem/rust-cache@v2
         if: github.event_name == 'pull_request' # only cache in pull requests
@@ -102,12 +109,6 @@ jobs:
         with:
           images: ${{ env.REGISTRY_IMAGE }}
 
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ env.DOCKER_HUB_USERNAME }}
-          password: ${{ env.DOCKER_HUB_PASSWORD }}
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -138,7 +139,7 @@ jobs:
 
   merge:
     name: Publish multi-platform image
-    runs-on: blacksmith-16vcpu-ubuntu-2404-arm
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu24-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
     needs:
       - build
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6bc55a6f..44ea8739 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,7 +22,7 @@ env:
 jobs:
   test:
     name: Test (PostgreSQL ${{ matrix.pg_version }})
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     strategy:
       fail-fast: false
       matrix:
@@ -47,6 +47,12 @@ jobs:
           CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
           CS_WORKSPACE_CRN: ${{ secrets.CS_VAULT_WORKSPACE_CRN }}
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_HUB_USERNAME }}
+          password: ${{ env.DOCKER_HUB_PASSWORD }}
+
       - run: |
           mise run postgres:up --extra-args "--detach --wait"
 
@@ -74,7 +80,7 @@ jobs:
   # change that raises the compiler requirement fails here.
   msrv:
     name: Build (Rust MSRV)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
 
     steps:
@@ -124,7 +130,7 @@ jobs:
   # adds Clippy lints, before the pinned toolchain is bumped to it.
   stable:
     name: Lint (Rust stable)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 30
     env:
       # Overrides rust-toolchain.toml.
@@ -154,7 +160,7 @@ jobs:
 
   burn-in:
     name: Encrypted burn-in (PostgreSQL 17)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 15
     env:
       PG_VERSION: 17
@@ -176,6 +182,12 @@ jobs:
           CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
           CS_WORKSPACE_CRN: ${{ secrets.CS_VAULT_WORKSPACE_CRN }}
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_HUB_USERNAME }}
+          password: ${{ env.DOCKER_HUB_PASSWORD }}
+
       - name: Start bare PostgreSQL and download EQL
         run: |
           mise run postgres:up --extra-args "--detach --wait"
@@ -200,7 +212,7 @@ jobs:
 
   pooler-compatibility:
     name: Supported pooler compatibility (PostgreSQL 17)
-    runs-on: blacksmith-16vcpu-ubuntu-2204
+    runs-on: runs-on=${{ github.run_id }}/family=c8a+m8a/cpu=8/image=ubuntu22-full-x64/volume=80gb/extras=s3-cache
     timeout-minutes: 45
     env:
       PG_VERSION: 17
@@ -223,6 +235,12 @@ jobs:
           CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_VAULT_CLIENT_ACCESS_KEY }}
           CS_WORKSPACE_CRN: ${{ secrets.CS_VAULT_WORKSPACE_CRN }}
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKER_HUB_USERNAME }}
+          password: ${{ env.DOCKER_HUB_PASSWORD }}
+
       - name: Verify gate rejects incomplete runs and induced regressions
         run: python3 tests/tasks/test/pooler_gate_test.py