diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index d24fa31..a5c884b 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -7,9 +7,21 @@ on:
   workflow_call:
     inputs:
       runs-on:
-        description: "Runner label(s) as a JSON array string (parsed with fromJSON). Defaults to the self-hosted pool. Public/open-source repos opt out by passing '[\"ubuntu-latest\"]'."
+        description: "Runner label(s) as a JSON array string (parsed with fromJSON). Defaults to a GitHub-hosted image; pass '[\"self-hosted\", \"linux\", \"x64\"]' to use a self-hosted pool instead."
         type: string
-        default: '["self-hosted", "linux", "x64"]'
+        # GitHub-hosted by default. This job reads the PR diff and calls the
+        # Claude API -- it needs no private-network access, no local toolchain
+        # and no persistent state, so a self-hosted runner buys it nothing.
+        #
+        # It cost quite a lot, though: on a contended pool the review queued
+        # 40-77 minutes for 3-6 minutes of work, routinely finishing after the
+        # PR had already merged, and failed outright at runner assignment
+        # roughly one run in six. Both faults are queueing artefacts, not
+        # review problems.
+        #
+        # Pinned to a dated image rather than ubuntu-latest so a GitHub-side
+        # image bump is an intentional, reviewable change.
+        default: '["ubuntu-24.04"]'
       timeout-minutes:
         type: number
         default: 30
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23ec30f..fceb802 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,27 @@ project uses [SemVer](https://semver.org/) for the `vMAJOR.MINOR.PATCH` tags.
 
 ## [Unreleased]
 
+### Changed
+
+- **`claude-code-review.yml` now defaults to a GitHub-hosted runner**
+  (`["ubuntu-24.04"]`) instead of `["self-hosted", "linux", "x64"]`. The job
+  reads a PR diff and calls the Claude API — it needs no private-network
+  access, no local toolchain and no persistent state, so a self-hosted runner
+  bought it nothing while costing a great deal on a contended pool: measured
+  queue times of 40–77 minutes for 3–6 minutes of work, reviews routinely
+  landing after the PR had already merged, and outright failure at runner
+  assignment in roughly one run in six. Both faults are queueing artefacts
+  rather than review problems.
+
+  **This changes behaviour for every consumer that does not pass `runs-on`
+  explicitly** — currently all but one. Consumers that want the old behaviour
+  pass `runs-on: '["self-hosted", "linux", "x64"]'`, which is what
+  `sproncy/monitoring_stack` already does and is therefore unaffected.
+
+  Hosted minutes are metered on private repos; a review is 3–6 minutes, so
+  budget accordingly. The image is pinned to a dated label rather than
+  `ubuntu-latest` so a GitHub-side bump is an intentional, reviewable change.
+
 ## [3.3.0] - 2026-09-10
 
 ### Added