diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68028e7..9e6375c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,9 +25,13 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+# On the estate's Hetzner runners since 2026-09-17: the org's 3000 included Actions
+# minutes ran out at 16:57 UTC that day and every GitHub-hosted job in hansenexus
+# stopped starting. The spending limit stays at $0.
+# Ruling: dec_2026-09-17_global-ci-on-hetzner-fleet-no-hosted-minutes
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
@@ -46,7 +50,7 @@ jobs:
         run: bun run test
 
   tarball:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
@@ -62,23 +66,23 @@ jobs:
         run: |
           set -euo pipefail
           bun run build
-          npm pack --pack-destination /tmp
-          ls -l /tmp/*.tgz
+          npm pack --pack-destination "$RUNNER_TEMP"
+          ls -l "$RUNNER_TEMP"/*.tgz
 
       - name: init/validate/build against the installed artifact
         run: |
           set -euo pipefail
-          mkdir -p /tmp/consumer && cd /tmp/consumer
+          mkdir -p "$RUNNER_TEMP/consumer" && cd "$RUNNER_TEMP/consumer"
           npm init -y >/dev/null
-          npm i /tmp/hansenexus-nextup-*.tgz >/dev/null
+          npm i "$RUNNER_TEMP"/hansenexus-nextup-*.tgz >/dev/null
           npx nextup init --project smoke --repo o/smoke --phases P0,P1
           npx nextup validate
           sed -i 's/public: false/public: true/' roadmap.yaml   # the public build refuses public:false by design
-          NEXTUP_NO_GH=1 npx nextup build --no-github --site --out /tmp/site && npx nextup build --audience internal --no-github --out /tmp/internal
-          test -s /tmp/site/index.html && test -s /tmp/site/nextup-roadmap.iife.js && test -s /tmp/internal/roadmap.internal.json
+          NEXTUP_NO_GH=1 npx nextup build --no-github --site --out "$RUNNER_TEMP/site" && npx nextup build --audience internal --no-github --out "$RUNNER_TEMP/internal"
+          test -s "$RUNNER_TEMP/site"/index.html && test -s "$RUNNER_TEMP/site"/nextup-roadmap.iife.js && test -s "$RUNNER_TEMP/internal"/roadmap.internal.json
 
   dist:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index abe5b9c..76b27c3 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -36,7 +36,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
@@ -55,7 +55,7 @@ jobs:
     # a broken site before it is merged, it does not preview it.
     if: github.event_name != 'pull_request'
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     permissions:
       pages: write
       id-token: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 19e5d60..cad02a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,7 @@ concurrency:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, hetzner]
     permissions:
       contents: write # create the GitHub release
       id-token: write # provenance attestation
@@ -118,11 +118,11 @@ jobs:
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
         run: |
           set -o pipefail
-          if npm publish --access public --dry-run 2>&1 | tee /tmp/publish.log; then
+          if npm publish --access public --dry-run 2>&1 | tee "$RUNNER_TEMP/publish.log"; then
             echo "dry run clean — this version is publishable"
             exit 0
           fi
-          if grep -q "cannot publish over the previously published versions" /tmp/publish.log; then
+          if grep -q "cannot publish over the previously published versions" "$RUNNER_TEMP/publish.log"; then
             echo "::notice::Authenticated to npm and the tarball is well-formed."
             echo "::notice::Version $(node -p "require('./package.json').version") is already published — bump before releasing."
             exit 0