diff --git a/.github/workflows/cloudflare-pages-deploy.yml b/.github/workflows/cloudflare-pages-deploy.yml
index e66aead..c45287c 100644
--- a/.github/workflows/cloudflare-pages-deploy.yml
+++ b/.github/workflows/cloudflare-pages-deploy.yml
@@ -73,7 +73,7 @@ on:
 jobs:
   deploy:
     name: Deploy to Cloudflare Pages
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 237b99f..6fe43fc 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -89,7 +89,7 @@ jobs:
   lint:
     name: Lint
     if: inputs.lint_command != ''
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -102,7 +102,7 @@ jobs:
   format:
     name: Format
     if: inputs.format_command != ''
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -115,7 +115,7 @@ jobs:
   typecheck:
     name: Typecheck
     if: inputs.typecheck_command != ''
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -128,7 +128,7 @@ jobs:
   test:
     name: Test
     if: inputs.test_command != ''
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -141,7 +141,7 @@ jobs:
   build:
     name: Build
     if: inputs.build_command != ''
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -164,7 +164,7 @@ jobs:
   actionlint:
     name: Actionlint
     if: inputs.actionlint
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ${{ inputs.runs-on }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
@@ -173,7 +173,7 @@ jobs:
     name: Gate
     needs: [lint, format, typecheck, test, build, actionlint]
     if: always()
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     steps:
       - name: Check results
         env:
diff --git a/.github/workflows/pr-opened.yml b/.github/workflows/pr-opened.yml
index b065d55..0797c44 100644
--- a/.github/workflows/pr-opened.yml
+++ b/.github/workflows/pr-opened.yml
@@ -19,7 +19,7 @@ on:
 
 jobs:
   get-commits:
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     outputs:
       commits: ${{ steps.format-commits.outputs.result }}
     steps:
diff --git a/.github/workflows/pr-updated.yml b/.github/workflows/pr-updated.yml
index 191dc18..6ef9aff 100644
--- a/.github/workflows/pr-updated.yml
+++ b/.github/workflows/pr-updated.yml
@@ -19,7 +19,7 @@ on:
 
 jobs:
   get-commits:
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     outputs:
       commits: ${{ steps.format-commits.outputs.result }}
     steps:
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 88ed995..050fcab 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   gate:
     name: Gate
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     timeout-minutes: 1
     steps:
       - name: Gate
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 58ab31e..3127dea 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -44,7 +44,7 @@ on:
 jobs:
   secret-scan:
     name: Secret Scan (gitleaks)
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       # gitleaks-action lists PR commits on pull_request events; without this it 403s.
@@ -60,7 +60,7 @@ jobs:
 
   security-scan:
     name: Security Scan (bearer)
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Bearer (fail on high severity)
diff --git a/.github/workflows/telegram-notify.yml b/.github/workflows/telegram-notify.yml
index 42cbc5d..c70a3e4 100644
--- a/.github/workflows/telegram-notify.yml
+++ b/.github/workflows/telegram-notify.yml
@@ -93,7 +93,7 @@ on:
 jobs:
   notify:
     name: Format and send
-    runs-on: "${{ vars.CI_RUNNER && fromJSON(vars.CI_RUNNER) || 'ubuntu-latest' }}"
+    runs-on: ubuntu-latest
     steps:
       - name: Build message
         id: format