diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 0dd701c13..82a2b6c3f 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,3 +3,4 @@ self-hosted-runner:
   labels:
     - blacksmith-8vcpu-ubuntu-2404-arm
     - blacksmith-8vcpu-windows-2025
+    - blacksmith-6vcpu-macos-26
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index 92970d59f..204e5fc05 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -65,7 +65,7 @@ jobs:
     name: Build macOS binary (${{ matrix.variant }})
     needs: changes
     if: ${{ always() && !cancelled() && ((github.event_name == 'pull_request' && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false')) || (github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch'))) }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -112,7 +112,7 @@ jobs:
       contents: read
       id-token: write
       attestations: write
-    runs-on: macos-26-xlarge
+    runs-on: macos-26
     timeout-minutes: 120
     strategy:
       fail-fast: false
diff --git a/.github/workflows/desktop-pr-build.yml b/.github/workflows/desktop-pr-build.yml
index 746201985..c1f5f6d1a 100644
--- a/.github/workflows/desktop-pr-build.yml
+++ b/.github/workflows/desktop-pr-build.yml
@@ -14,7 +14,7 @@ jobs:
   build-macos:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
@@ -58,7 +58,7 @@ jobs:
   build-research-dev-macos:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
diff --git a/.github/workflows/mobile-pr-build.yml b/.github/workflows/mobile-pr-build.yml
index d1445fec8..9d9803f17 100644
--- a/.github/workflows/mobile-pr-build.yml
+++ b/.github/workflows/mobile-pr-build.yml
@@ -14,7 +14,7 @@ jobs:
   build-ios:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.ios != 'false') }}
-    runs-on: macos-26
+    runs-on: blacksmith-6vcpu-macos-26
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
         with:
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 898d7644c..ae008148b 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -62,7 +62,13 @@ release work, and report the tag and commit before publishing.
 
 ## macOS runners and Apple toolchain
 
-macOS jobs use explicit ARM64 `macos-26` or `macos-26-xlarge` runners. Research
+Unsigned Research desktop/iOS PR builds and Agent release-binary jobs use
+explicit ARM64 `blacksmith-6vcpu-macos-26` runners. Other macOS jobs retain
+`macos-26` or `macos-26-xlarge` runners. Agent preview packaging and protected
+signing use standard GitHub `macos-26` runners to assemble prebuilt binaries.
+The Agent's final signed-package
+provenance identifies the GitHub packaging/signing job; Blacksmith is trusted
+for prebuilt binary integrity. Research
 desktop and iOS builds select stable Xcode 26.5, build `17F42`, from
 [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
 the shared selector, which aligns the runner's active `xcode-select` directory
diff --git a/scripts/ci/test_agent_workflows.py b/scripts/ci/test_agent_workflows.py
index b1949a443..70b359ff1 100644
--- a/scripts/ci/test_agent_workflows.py
+++ b/scripts/ci/test_agent_workflows.py
@@ -155,6 +155,7 @@ def test_only_trusted_master_can_receive_apple_signing_credentials(self):
         jobs = config["jobs"]
         signed = jobs["macos"]
         self.assertEqual(signed["environment"], "desktop-signing")
+        self.assertEqual(signed["runs-on"], "macos-26")
         condition = " ".join(signed["if"].split())
         self.assertIn(self.MASTER_GUARD, condition)
         self.assertIn("always() && !cancelled()", condition)