diff --git a/.gitea/workflows/auto-label.yml b/.gitea/workflows/auto-label.yml
index 759928e2..d47463c9 100644
--- a/.gitea/workflows/auto-label.yml
+++ b/.gitea/workflows/auto-label.yml
@@ -12,7 +12,7 @@ jobs:
   # a demand comment — filing is not complete until prioritized.
   priority-gate:
     if: github.event_name == 'issues' && github.event.action != 'labeled'
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - name: Enforce priority label
         uses: actions/github-script@v7
@@ -44,7 +44,7 @@ jobs:
             });
 
   auto-label:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - name: Analyze and label
         uses: actions/github-script@v7
diff --git a/.gitea/workflows/auto-version.yml b/.gitea/workflows/auto-version.yml
index 3476377f..2ea0a0ad 100644
--- a/.gitea/workflows/auto-version.yml
+++ b/.gitea/workflows/auto-version.yml
@@ -9,7 +9,7 @@ permissions: write-all
 
 jobs:
   release:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.gitea/workflows/maintenance.yml b/.gitea/workflows/maintenance.yml
index 197cd021..71a5c57b 100644
--- a/.gitea/workflows/maintenance.yml
+++ b/.gitea/workflows/maintenance.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   lint-and-format:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Lint Python files
@@ -18,7 +18,7 @@ jobs:
           ruff format shared/ src/ || true
 
   canary-suite:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Run all canaries
@@ -34,7 +34,7 @@ jobs:
           exit $FAILED
 
   best-practices:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Check best practices
@@ -67,7 +67,7 @@ jobs:
           grep -rn "TODO\|FIXME\|HACK\|XXX" shared/ src/ --include="*.py" | head -10 || echo "  Clean"
 
   documentation-check:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - uses: actions/checkout@v4
       - name: Check documentation coverage
diff --git a/.gitea/workflows/pipeline-gate.yml b/.gitea/workflows/pipeline-gate.yml
index 34ae219c..e048213d 100644
--- a/.gitea/workflows/pipeline-gate.yml
+++ b/.gitea/workflows/pipeline-gate.yml
@@ -16,7 +16,7 @@ jobs:
   # `Depends on: #N` reference in its body is CLOSED. Otherwise Gitea
   # blocks the stage (removes ready, adds blocked, names the blocker).
   gate:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - name: Verify dependency order before allowing ready
         uses: actions/github-script@v7
@@ -82,7 +82,7 @@ jobs:
   # issue (open, has the orchestration-stage marker in its body, all deps
   # closed) and label it ready — the order teacher keeps Rune on task.
   teach:
-    runs-on: self-hosted
+    runs-on: rune-infra-pi
     steps:
       - name: Announce the next issue in dependency order
         uses: actions/github-script@v7