diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 04289144..f9c2cd30 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,14 +19,14 @@ concurrency:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    # Pull requests are untrusted and must use an ephemeral GitHub-hosted runner.
-    # Trusted branch pushes may use the local backend pool for throughput.
+    # Pull requests are untrusted and use ephemeral runners; trusted pushes use the local pool.
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
     strategy:
       fail-fast: false
       matrix:
         suite: [unit, integration, api, legacy]
     env:
+      DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_PROJECT_NAME: php-${{ github.run_id }}-${{ github.job }}-${{ matrix.suite }}-${{ github.run_attempt }}
 
     steps:
@@ -116,6 +116,8 @@ jobs:
   edge-broker:
     name: Edge Broker (required)
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    env:
+      DOCKER_HOST: unix:///var/run/docker.sock
 
     steps:
       - name: Checkout
@@ -159,6 +161,7 @@ jobs:
     name: Edge Gateway Backend (required)
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
     env:
+      DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
       COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
       COMPOSE_PROFILES: dev