diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f000797..58ffad6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
 
   required:
     name: required
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     needs: [rust]
     if: always()
     steps:
@@ -62,7 +62,7 @@ jobs:
     name: GitHub Release
     needs: [required]
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     permissions:
       contents: write # create the release and upload its assets
       id-token: write # sign the provenance attestation through Sigstore
diff --git a/.github/workflows/conventional-title-labeler.yml b/.github/workflows/conventional-title-labeler.yml
index 1daf978..7299774 100644
--- a/.github/workflows/conventional-title-labeler.yml
+++ b/.github/workflows/conventional-title-labeler.yml
@@ -21,7 +21,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     steps:
       - name: Map conventional title prefix to a C-* label
         # TITLE is read from env (never interpolated into the script) to avoid
diff --git a/.github/workflows/dependency-licences.yml b/.github/workflows/dependency-licences.yml
index 259c173..2bd13e1 100644
--- a/.github/workflows/dependency-licences.yml
+++ b/.github/workflows/dependency-licences.yml
@@ -20,7 +20,7 @@ permissions: {}
 jobs:
   licence-check:
     name: licence check (warn-only)
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/label-sync.yml b/.github/workflows/label-sync.yml
index 0fd95ea..fc9eeb6 100644
--- a/.github/workflows/label-sync.yml
+++ b/.github/workflows/label-sync.yml
@@ -28,7 +28,7 @@ permissions:
 jobs:
   sync:
     name: Sync Labels
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 4708263..6ffb237 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     steps:
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
diff --git a/.github/workflows/pr-size-labeler.yml b/.github/workflows/pr-size-labeler.yml
index f2766a2..7dfc74f 100644
--- a/.github/workflows/pr-size-labeler.yml
+++ b/.github/workflows/pr-size-labeler.yml
@@ -26,7 +26,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.USE_SELF_HOSTED == 'true' && fromJSON('["self-hosted","linux","x64","zima"]') || 'ubuntu-latest' }}
     steps:
       - uses: pascalgn/size-label-action@56b489b027932ec0cf60438a1a5f1a19c8fc71ff # v0.5.7
         env: