diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27b79e6..c7146fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -29,7 +29,7 @@ jobs:
 
   check:
     name: Typecheck
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -47,7 +47,7 @@ jobs:
 
   build:
     name: Production builds
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
@@ -76,7 +76,7 @@ jobs:
 
   test:
     name: Unit tests
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     steps:
       - uses: actions/checkout@v5
         with:
@@ -94,7 +94,7 @@ jobs:
 
   test-integration:
     name: Postgres journeys
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v5
@@ -118,7 +118,7 @@ jobs:
     name: Publish compatible mobile update
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: [lint, check, build, test, test-integration, test-e2e]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 20
     concurrency:
       group: mobile-production-update
@@ -271,7 +271,7 @@ jobs:
       github.ref == 'refs/heads/main' &&
       vars.PRODUCTION_DEPLOY_ENABLED == 'true'
     needs: [lint, check, build, test, test-integration, test-e2e]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 30
     concurrency:
       group: production
diff --git a/.github/workflows/desktop-macos-screenshot.yml b/.github/workflows/desktop-macos-screenshot.yml
index 529e8ed..0e0631f 100644
--- a/.github/workflows/desktop-macos-screenshot.yml
+++ b/.github/workflows/desktop-macos-screenshot.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   screenshot:
     name: macOS setup screenshot
-    runs-on: macos-26
+    runs-on: [self-hosted, evoo-ci, macOS]
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v5
diff --git a/.github/workflows/mobile-android-screenshots.yml b/.github/workflows/mobile-android-screenshots.yml
index d6db223..5642039 100644
--- a/.github/workflows/mobile-android-screenshots.yml
+++ b/.github/workflows/mobile-android-screenshots.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   screenshots:
     name: Capture Android UI
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 45
     services:
       postgres:
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index e6848d8..eade067 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -53,7 +53,7 @@ permissions:
 jobs:
   playwright:
     name: Web E2E
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 20
     concurrency:
       group: ${{ inputs.publish_report && 'playwright-publication' || format('playwright-{0}', github.run_id) }}
@@ -72,8 +72,8 @@ jobs:
           key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
       - name: Install Chromium
         timeout-minutes: 5
-        # Skip --with-deps: GitHub ubuntu-latest already has Chromium's OS libraries,
-        # and apt-get against azure.archive.ubuntu.com can stall until the job timeout.
+        # Skip --with-deps: evo Linux runners keep Chromium's OS libraries installed,
+        # and apt-get can stall until the job timeout on persistent self-hosted machines.
         run: pnpm --filter @rakazo/web exec playwright install chromium
       - name: Validate E2B credentials
         if: inputs.sandbox_provider == 'e2b'
diff --git a/.github/workflows/publish-playwright-report.yml b/.github/workflows/publish-playwright-report.yml
index 273b208..4d3dc4c 100644
--- a/.github/workflows/publish-playwright-report.yml
+++ b/.github/workflows/publish-playwright-report.yml
@@ -24,7 +24,7 @@ jobs:
       (github.event.workflow_run.event == 'pull_request' ||
        (github.event.workflow_run.event == 'push' &&
         github.event.workflow_run.head_branch == 'main'))
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 10
     steps:
       # workflow_run has repository secrets. Always use trusted default-branch code here;
diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml
index 5df6c59..3c58ad7 100644
--- a/.github/workflows/publish-server-image.yml
+++ b/.github/workflows/publish-server-image.yml
@@ -36,7 +36,7 @@ jobs:
   installer-smoke:
     name: Compose installer smokes
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 5
     permissions:
       contents: read
@@ -49,7 +49,7 @@ jobs:
   validate:
     name: Validate ${{ matrix.name }} image
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 90
     permissions:
       contents: read
@@ -93,8 +93,9 @@ jobs:
     name: Build ${{ matrix.name }} ${{ matrix.arch }}
     if: github.event_name != 'pull_request'
     # Each architecture builds natively on its own runner and pushes by digest only.
-    # No QEMU: GitHub hosts native arm64 runners, and emulated arm64 took hours for the
-    # desktop-sized computer image. See docs/self-host.md (Published images and tags).
+    # amd64 on evo Linux runners; arm64 on Apple Silicon macOS runners (linux/arm64 via buildx).
+    # No QEMU: emulated arm64 took hours for the desktop-sized computer image.
+    # See docs/self-host.md (Published images and tags).
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
     permissions:
@@ -118,9 +119,9 @@ jobs:
             dockerfile: infra/sandboxes/computer/Dockerfile
             context: infra/sandboxes/computer
           - arch: amd64
-            runner: ubuntu-latest
+            runner: [self-hosted, evoo-ci, Linux]
           - arch: arm64
-            runner: ubuntu-24.04-arm
+            runner: [self-hosted, evoo-ci, macOS]
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
@@ -171,7 +172,7 @@ jobs:
     name: Publish ${{ matrix.name }} image
     if: github.event_name != 'pull_request'
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 15
     permissions:
       contents: read
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index 99e3c0e..bac3e64 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   validate:
     name: Validate stable release
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, evoo-ci, Linux]
     outputs:
       tag: ${{ steps.release.outputs.tag }}
       version: ${{ steps.release.outputs.version }}
@@ -93,9 +93,10 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          include='[{"os":"macos-26","artifact":"macos"},{"os":"ubuntu-24.04","artifact":"linux"}]'
+          include='[{"runner":["self-hosted","evoo-ci","macOS"],"artifact":"macos"},{"runner":["self-hosted","evoo-ci","Linux"],"artifact":"linux"}]'
           if [[ "$WINDOWS_SIGNING" == "true" ]]; then
-            include="$(jq -c '. + [{"os":"windows-2022","artifact":"windows"}]' <<<"$include")"
+            # No self-hosted Windows runner; keep GitHub-hosted only when signing credentials exist.
+            include="$(jq -c '. + [{"runner":"windows-2022","artifact":"windows"}]' <<<"$include")"
           fi
           echo "include=$include" >> "$GITHUB_OUTPUT"
           echo "windows=$WINDOWS_SIGNING" >> "$GITHUB_OUTPUT"
@@ -103,7 +104,7 @@ jobs:
   build:
     name: Build signed ${{ matrix.artifact }} artifacts
     needs: validate
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     strategy:
       fail-fast: false
@@ -261,7 +262,7 @@ jobs:
   publish:
     name: Attest and publish complete release
     needs: [validate, build]
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 15
     permissions:
       actions: read
diff --git a/.github/workflows/topology-verification.yml b/.github/workflows/topology-verification.yml
index a1aa876..697ed25 100644
--- a/.github/workflows/topology-verification.yml
+++ b/.github/workflows/topology-verification.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   topology:
     name: Production topology smoke
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5