diff --git a/.github/workflows/code_quality.yml b/.github/workflows/code_quality.yml
index 27d10dea..4f758870 100644
--- a/.github/workflows/code_quality.yml
+++ b/.github/workflows/code_quality.yml
@@ -9,12 +9,12 @@ on:
 
 jobs:
   qodana:
-    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
-    runs-on: [self-hosted, Linux, X64, default]
+    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
+    runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
-      checks: write
+      contents: read
+      pull-requests: read
+      checks: read
     steps:
       - uses: actions/checkout@v4
         with: