diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f9c2cd30..36fca631 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,8 +19,8 @@ concurrency:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    # Pull requests are untrusted and use ephemeral runners; trusted pushes use the local pool.
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    # Docker jobs use disposable workspaces so root-owned container artifacts cannot poison later checkouts.
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -115,7 +115,7 @@ jobs:
 
   edge-broker:
     name: Edge Broker (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
 
@@ -159,7 +159,7 @@ jobs:
 
   edge-gateway-backend:
     name: Edge Gateway Backend (required)
-    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    runs-on: ubuntu-24.04
     env:
       DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml