diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9c71b8e0..43c003ca5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ env:
 jobs:
   quality:
     name: lint, types, wheel and deployment contracts
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -110,7 +110,7 @@ jobs:
 
   tests:
     name: tests (Python ${{ matrix.python }})
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
     strategy:
       fail-fast: false
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 38be7edcb..37aeb0844 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -18,6 +18,9 @@ env:
 
 jobs:
   publish:
+    # GitHub-hosted on purpose: this job produces the build provenance, and a Blacksmith runner is
+    # recorded as runnerEnvironment=self-hosted, which `gh attestation verify
+    # --deny-self-hosted-runners` (this workflow and approve-image-update.yml) rejects.
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions: