diff --git a/.github/workflows/conventional-title-labeler.yml b/.github/workflows/conventional-title-labeler.yml
index 88fd55d..790ac18 100644
--- a/.github/workflows/conventional-title-labeler.yml
+++ b/.github/workflows/conventional-title-labeler.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Map conventional title prefix to a C-* label
         # TITLE is read from env (never interpolated into the script) to avoid
diff --git a/.github/workflows/dependency-licences.yml b/.github/workflows/dependency-licences.yml
index 2bd13e1..259c173 100644
--- a/.github/workflows/dependency-licences.yml
+++ b/.github/workflows/dependency-licences.yml
@@ -20,7 +20,7 @@ permissions: {}
 jobs:
   licence-check:
     name: licence check (warn-only)
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/hooks-sync.yml b/.github/workflows/hooks-sync.yml
index 42b3515..4fffa46 100644
--- a/.github/workflows/hooks-sync.yml
+++ b/.github/workflows/hooks-sync.yml
@@ -31,7 +31,7 @@ permissions:
 jobs:
   lint:
     name: shellcheck + parse
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -55,7 +55,7 @@ jobs:
 
   smoke:
     name: smoke — raw-fetch fallback path
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/hooks-tests.yml b/.github/workflows/hooks-tests.yml
index 92a45c7..046bad6 100644
--- a/.github/workflows/hooks-tests.yml
+++ b/.github/workflows/hooks-tests.yml
@@ -32,7 +32,7 @@ permissions:
 jobs:
   bats:
     name: bats
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index fc9eeb6..0fd95ea 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -28,7 +28,7 @@ permissions:
 jobs:
   sync:
     name: Sync Labels
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 6ffb237..4708263 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
diff --git a/.github/workflows/pr-size-labeler.yml b/.github/workflows/pr-size-labeler.yml
index 9a83ad9..c563fd3 100644
--- a/.github/workflows/pr-size-labeler.yml
+++ b/.github/workflows/pr-size-labeler.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: pascalgn/size-label-action@56b489b027932ec0cf60438a1a5f1a19c8fc71ff # v0.5.7
         env:
diff --git a/.github/workflows/repo-drift.yml b/.github/workflows/repo-drift.yml
index 47bf44e..e041f93 100644
--- a/.github/workflows/repo-drift.yml
+++ b/.github/workflows/repo-drift.yml
@@ -46,7 +46,7 @@ concurrency:
 jobs:
   drift:
     name: installer repo list matches the org
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/required.yml b/.github/workflows/required.yml
index 259f763..4c7335e 100644
--- a/.github/workflows/required.yml
+++ b/.github/workflows/required.yml
@@ -32,7 +32,7 @@ concurrency:
 jobs:
   shellcheck:
     name: shellcheck (install.sh + scripts)
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -443,7 +443,7 @@ jobs:
 
   powershell:
     name: PowerShell parse + analyze (*.ps1)
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -533,7 +533,7 @@ jobs:
 
   worker:
     name: worker (get.resq.software)
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -592,7 +592,7 @@ jobs:
     name: required
     needs: [shellcheck, powershell, worker]
     if: always()
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Gate on required checks
         run: |
diff --git a/.github/workflows/worker-live.yml b/.github/workflows/worker-live.yml
index f2e9a97..240b4ca 100644
--- a/.github/workflows/worker-live.yml
+++ b/.github/workflows/worker-live.yml
@@ -44,7 +44,7 @@ concurrency:
 jobs:
   live:
     name: live endpoint matches main
-    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     # Backstop only. The script enforces its own DEADLINE_MS (20 minutes) and
     # prints a diagnosis when it expires; this must stay comfortably above that
     # or the job is killed first and that diagnosis is lost. It exists so a