diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f022e8..544a95c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,7 +37,7 @@ permissions:
 
 jobs:
   gate:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     # A ceiling, not a budget. The default is six hours, and a `go test` that deadlocks
     # would hold a runner for all of them without printing a failure.
     timeout-minutes: 15
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 369a3f1..2647f08 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 60
     steps:
       - name: Checkout
@@ -43,8 +43,8 @@ jobs:
       - name: Set up Task
         uses: go-task/setup-task@v2
 
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # Without this, `--cache-to type=gha` below is a silent no-op: the tokens BuildKit
       # needs reach JavaScript actions and not `run:` steps. See the long note in qemu.yml.
diff --git a/.github/workflows/kernel.yml b/.github/workflows/kernel.yml
index 45f6271..2a3ad7c 100644
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 180
     steps:
       - name: Checkout
@@ -41,8 +41,8 @@ jobs:
       - name: Set up Task
         uses: go-task/setup-task@v2
 
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # Without this, `--cache-to type=gha` below is a silent no-op: the tokens BuildKit
       # needs reach JavaScript actions and not `run:` steps. See the long note in qemu.yml.
diff --git a/.github/workflows/qemu.yml b/.github/workflows/qemu.yml
index 10c9c88..af7cbe2 100644
--- a/.github/workflows/qemu.yml
+++ b/.github/workflows/qemu.yml
@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     # A cold build is tens of minutes and a warm one is a cache restore, so the spread is
     # wide and the ceiling has to sit above the cold case. What it is really for is the
     # other end: a `configure` that stops on a prompt would hold a runner for six hours
@@ -55,8 +55,8 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # What makes `--cache-to type=gha` do anything at all.
       #
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa263ce..20bbfad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,7 @@ concurrency:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     # QEMU and the kernel are each tens of minutes from cold, on a runner with two cores,
     # and this job builds both plus the image. The GitHub Actions cache makes a warm run
     # far shorter; the ceiling is for the cold one.
@@ -60,8 +60,8 @@ jobs:
       - name: Set up Task
         uses: go-task/setup-task@v2
 
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # Without this, `--cache-to type=gha` below is a silent no-op: the tokens BuildKit
       # needs reach JavaScript actions and not `run:` steps. See the long note in qemu.yml.