diff --git a/.github/workflows/actions-pinned-check.yml b/.github/workflows/actions-pinned-check.yml
index 70c3aa5..378f1ba 100644
--- a/.github/workflows/actions-pinned-check.yml
+++ b/.github/workflows/actions-pinned-check.yml
@@ -13,11 +13,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read # actions/checkout needs this to fetch a private repo
+  contents: read # actions/checkout
 
 jobs:
   check:
-    runs-on: opus-runner-standard
+    # This repo is public, so the gate must stay on a hosted runner: a fork PR
+    # runs untrusted code, and self-hosted runners would execute it on our own
+    # infrastructure. The check is shell-only and needs nothing a hosted runner
+    # lacks. https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/manage-access#self-hosted-runner-security-with-public-repositories
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
diff --git a/.github/workflows/check-pr-basic.yml b/.github/workflows/check-pr-basic.yml
index 0ef97af..6141183 100644
--- a/.github/workflows/check-pr-basic.yml
+++ b/.github/workflows/check-pr-basic.yml
@@ -22,4 +22,6 @@ jobs:
       - uses: thehanimo/pr-title-checker@1d8cd483a2b73118406a187f54dca8a9415f1375 # v1.4.2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          configuration_path: pull_request_title.json
\ No newline at end of file
+          # The config lives in this repo, so read it off the checkout above
+          # rather than through the contents API, which this job cannot reach.
+          local_configuration_path: pull_request_title.json
\ No newline at end of file