diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e1363ab..7bc0da9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 jobs:
   verify:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/spec-drift.yml b/.github/workflows/spec-drift.yml
index 87037c1..ff678c4 100644
--- a/.github/workflows/spec-drift.yml
+++ b/.github/workflows/spec-drift.yml
@@ -12,7 +12,7 @@ jobs:
   update:
     # Scheduled runs use the default branch. Reject manual runs from other refs.
     if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 20
     permissions:
       contents: write
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
index f411d0a..4ec04ca 100644
--- a/.github/workflows/version.yml
+++ b/.github/workflows/version.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   version:
     if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     timeout-minutes: 15
     outputs:
       has_changesets: ${{ steps.changesets.outputs.hasChangesets }}
@@ -59,7 +59,7 @@ jobs:
   # other PRs are still pending.
   eligibility:
     needs: version
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       eligible: ${{ steps.plan.outputs.eligible }}
     permissions:
@@ -83,7 +83,7 @@ jobs:
   publish:
     needs: [eligibility, validate]
     if: needs.eligibility.outputs.eligible == 'true'
-    runs-on: ubuntu-latest
+    runs-on: runpod-4vCPU-ubuntu-2404 # GitHub-hosted (trusted publishing needs that) with allow-listed static IPs
     timeout-minutes: 20
     environment: npm
     permissions: