diff --git a/.github/workflows/code_quality.yml b/.github/workflows/code_quality.yml
index 64c5f501..bca26bf1 100644
--- a/.github/workflows/code_quality.yml
+++ b/.github/workflows/code_quality.yml
@@ -9,8 +9,8 @@ on:
 
 jobs:
   qodana:
-    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
-    runs-on: ubuntu-latest
+    # CI runs on the repository's self-hosted runner pool.
+    runs-on: [self-hosted, Linux, X64, default]
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/copilot.yml b/.github/workflows/copilot.yml
index 6177bd06..d91cefde 100644
--- a/.github/workflows/copilot.yml
+++ b/.github/workflows/copilot.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   assign-task:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
     permissions:
       issues: write
     steps:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f66914d7..573d564e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,7 +7,7 @@ on:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
     strategy:
       fail-fast: false
       matrix:
@@ -44,7 +44,7 @@ jobs:
 
   edge-agent:
     name: Edge Agent (required)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
 
     steps:
       - name: Checkout
@@ -91,7 +91,7 @@ jobs:
 
   edge-broker:
     name: Edge Broker (required)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
 
     steps:
       - name: Checkout
@@ -125,7 +125,7 @@ jobs:
 
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
     env:
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
       COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
@@ -258,7 +258,7 @@ jobs:
 
   release-manager-gate:
     name: Release Manager gate
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, default]
     needs: [php, edge-agent, edge-broker, edge-gateway-backend]
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}