diff --git a/.github/workflows/ci-cd-build-deploy-maven-lib.yml b/.github/workflows/ci-cd-build-deploy-maven-lib.yml
index cb78658..6fe7e66 100644
--- a/.github/workflows/ci-cd-build-deploy-maven-lib.yml
+++ b/.github/workflows/ci-cd-build-deploy-maven-lib.yml
@@ -34,6 +34,19 @@ on:
             - application-type        - string, always 'maven-library'
           For optional fields see possible inputs to the create-build-envs action.
         required: true
+      runs-on:
+        type: string
+        required: false
+        # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON
+        # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is
+        # (like the terraform actions), so opting in is just a plain string — no JSON.
+        default: ""
+        description: |
+          Global runner for all jobs, as a plain string: a single GitHub-hosted larger runner name
+          (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the
+          self-hosted pool [self-hosted, dsb-builder, linux, x64]. Can be overridden per application
+          with a 'runs-on' field on an entry in 'apps'. The final 'ci-cd-conclusion' gate always
+          runs on ubuntu-latest.
       # below are repo-specific settings, not app specific and thus does not belong in 'apps'
       # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml'
       # sane defaults are defined but can be overridden pr. repo
@@ -65,7 +78,7 @@ on:
 jobs:
   create-matrix:
     name: Create build matrix
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
@@ -91,7 +104,8 @@ jobs:
   build-and-deploy:
     name: Build and deploy to artifact repo
     needs: create-matrix
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    # per-app 'runs-on' wins, else the global input, else the self-hosted default
+    runs-on: ${{ matrix.app-vars.runs-on || inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     strategy:
       matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }}
     defaults:
@@ -213,7 +227,7 @@ jobs:
       &&
       ( github.event_name != 'pull_request' || github.event.action == 'closed' )
     needs: [create-matrix, build-and-deploy]
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/ci-cd-default.yml b/.github/workflows/ci-cd-default.yml
index 1409686..332353e 100644
--- a/.github/workflows/ci-cd-default.yml
+++ b/.github/workflows/ci-cd-default.yml
@@ -40,6 +40,19 @@ on:
             - application-name        - string
           For optional fields see possible inputs to the create-build-envs action.
         required: true
+      runs-on:
+        type: string
+        required: false
+        # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON
+        # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is
+        # (like the terraform actions), so opting in is just a plain string — no JSON.
+        default: ""
+        description: |
+          Global runner for all jobs, as a plain string: a single GitHub-hosted larger runner name
+          (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the
+          self-hosted pool [self-hosted, dsb-builder, linux, x64]. Can be overridden per application
+          with a 'runs-on' field on an entry in 'apps'. The final 'ci-cd-conclusion' gate always
+          runs on ubuntu-latest.
       # below are repo-specific settings, not app specific and thus does not belong in 'apps'
       # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml'
       # sane defaults are defined but can be overridden pr. repo
@@ -71,7 +84,7 @@ on:
 jobs:
   check-docker-disk-space:
     name: Check Docker Disk Space & Prune if Needed
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
@@ -91,7 +104,7 @@ jobs:
   create-matrix:
     name: Create build matrix
     needs: check-docker-disk-space
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
@@ -133,7 +146,8 @@ jobs:
   build-deploy:
     name: Build and deploy
     needs: create-matrix
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    # per-app 'runs-on' wins, else the global input, else the self-hosted default
+    runs-on: ${{ matrix.app-vars.runs-on || inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     strategy:
       matrix: ${{ fromJSON(needs.create-matrix.outputs.app-vars-matrix) }}
       fail-fast: false
@@ -468,7 +482,7 @@ jobs:
     if: |
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch' )
     needs: [create-matrix, build-deploy]
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
@@ -546,7 +560,7 @@ jobs:
       &&
       ( github.event_name != 'pull_request' || github.event.action == 'closed' )
     needs: [create-matrix, build-deploy]
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/maven-artifacts-pruner.yml b/.github/workflows/maven-artifacts-pruner.yml
index a8baf29..86ebe6e 100644
--- a/.github/workflows/maven-artifacts-pruner.yml
+++ b/.github/workflows/maven-artifacts-pruner.yml
@@ -6,6 +6,18 @@ name: "DSB retention policy for maven artifacts in GitHub Packages"
 on:
   workflow_call:
     inputs:
+      runs-on:
+        type: string
+        required: false
+        # Empty (default) = the historical self-hosted pool, kept inside the workflow as a fromJSON
+        # fallback so callers that don't set this are unaffected. Any non-empty value is used as-is
+        # (like the terraform actions), so opting in is just a plain string — no JSON.
+        default: ""
+        description: |
+          Runner for the prune job, as a plain string: a single GitHub-hosted larger runner name
+          (matched by name), e.g. 'builder-app-platform-ghr-ubuntu-large'. Empty (default) uses the
+          self-hosted pool [self-hosted, dsb-builder, linux, x64]. The 'ci-cd-conclusion' gate
+          always runs on ubuntu-latest.
       # for explanation of maven artifact pruning configuration see inputs of 'ci-cd/prune-maven-artifacts-in-repo/action.yml'
       # sane defaults are defined but can be overridden pr. repo
       release-prune-keep-min-count:
@@ -45,7 +57,7 @@ jobs:
   prune-maven-artifacts:
     name: Prune maven artifacts
     # This job handles pruning of maven artifacts published in the calling repo
-    runs-on: [self-hosted, dsb-builder, linux, x64]
+    runs-on: ${{ inputs.runs-on || fromJSON('["self-hosted", "dsb-builder", "linux", "x64"]') }}
     defaults:
       run:
         shell: bash