diff --git a/.github/workflows/mirror_release_to_s3.yml b/.github/workflows/mirror_release_to_s3.yml
index 5825d98d..acd338c5 100644
--- a/.github/workflows/mirror_release_to_s3.yml
+++ b/.github/workflows/mirror_release_to_s3.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   mirror:
     name: Mirror ${{ inputs.tags }}
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 120
     permissions:
       contents: read
diff --git a/.github/workflows/promote_release.yml b/.github/workflows/promote_release.yml
index 3f9261cb..d71e13dc 100644
--- a/.github/workflows/promote_release.yml
+++ b/.github/workflows/promote_release.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   promote:
     name: Promote ${{ inputs.version }}
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     permissions:
       contents: write
       id-token: write
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index be778c31..79a40f93 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -23,7 +23,7 @@ jobs:
   # pull_request -- push (main), tags and dispatch run everything outright.
   dynamic-ci-filter:
     name: Dynamic CI Filter
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     if: github.event_name == 'pull_request'
     # Per-job outputs are set at runtime, so they are re-exported here by name.
@@ -298,7 +298,7 @@ jobs:
 
   trunk_check_runner:
     name: Trunk Check runner [linux]
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -337,7 +337,7 @@ jobs:
 
   build_pyo3:
     name: Build context-py
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -355,7 +355,7 @@ jobs:
 
   build_wasm:
     name: Build context-js (WASM)
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -373,7 +373,7 @@ jobs:
 
   gate:
     name: PR Gate
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     # Branch-protection fan-in: one stable required context for this whole workflow.
     # A matrix job skipped by its job-level `if:` reports a single check run under the
diff --git a/.github/workflows/pyo3.yml b/.github/workflows/pyo3.yml
index 4732a812..dbe137c4 100644
--- a/.github/workflows/pyo3.yml
+++ b/.github/workflows/pyo3.yml
@@ -24,7 +24,7 @@ jobs:
   # pull_request -- push (main), tags and dispatch run everything outright.
   dynamic-ci-filter:
     name: Dynamic CI Filter
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     if: github.event_name == 'pull_request'
     # Per-job outputs are set at runtime, so they are re-exported here by name.
@@ -42,7 +42,7 @@ jobs:
           token: ${{ secrets.TRUNK_PROD_ORG_API_TOKEN }}
 
   get-date-sha:
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     outputs:
       date: ${{ steps.get-date-sha.outputs.date }}
       sha: ${{ steps.get-date-sha.outputs.sha }}
@@ -309,7 +309,7 @@ jobs:
       needs.get-date-sha.result == 'success' &&
       (github.event_name != 'pull_request' ||
       needs.dynamic-ci-filter.outputs.sdist != 'false')
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     steps:
       - uses: actions/checkout@v4
       - name: Setup Rust & Cargo
@@ -339,7 +339,7 @@ jobs:
   publish-annotation:
     needs: [get-date-sha, linux, macos, sdist]
     if: always() && github.event_name != 'pull_request' && needs.linux.result == 'success' && needs.macos.result == 'success' && needs.sdist.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     steps:
       - name: Annotate workflow with S3 reference
         run: |
@@ -347,7 +347,7 @@ jobs:
 
   gate:
     name: context-py Gate
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     # Branch-protection fan-in: one stable required context for this whole workflow.
     # A matrix job skipped by its job-level `if:` reports a single check run under the
diff --git a/.github/workflows/release_cli.yml b/.github/workflows/release_cli.yml
index bef23c7c..2114a0a7 100644
--- a/.github/workflows/release_cli.yml
+++ b/.github/workflows/release_cli.yml
@@ -239,7 +239,7 @@ jobs:
 
   tag_and_release:
     name: Tag and Release [ ${{ github.event.inputs.release_tag || inputs.release_tag }} ]
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [build_release, perform_smoke_test]
     permissions:
       contents: write
diff --git a/.github/workflows/release_ruby_gem.yml b/.github/workflows/release_ruby_gem.yml
index cf9714db..3ac9300c 100644
--- a/.github/workflows/release_ruby_gem.yml
+++ b/.github/workflows/release_ruby_gem.yml
@@ -22,7 +22,7 @@ permissions:
 
 jobs:
   ci-data:
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     outputs:
       result: ${{ steps.fetch.outputs.result }}
     steps:
@@ -43,7 +43,7 @@ jobs:
             exclude: [head]
   cross-gem:
     name: ${{ matrix.platform == 'ruby' && 'Validate ruby platform gem' || format('Build gem for {0}', matrix.platform) }}
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: ci-data
     strategy:
       matrix:
@@ -188,7 +188,7 @@ jobs:
           knapsack-pro-test-suite-token-rspec: ${{ secrets.KNAPSACK_PRO_TEST_SUITE_TOKEN_RSPEC }}
 
   publish_ruby_gem:
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [test-ruby-gem, test-musl-gem]
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index e3993627..016a62d4 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -19,7 +19,7 @@ jobs:
   # pull_request -- push (main), tags and dispatch run everything outright.
   dynamic-ci-filter:
     name: Dynamic CI Filter
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     if: github.event_name == 'pull_request'
     # Per-job outputs are set at runtime, so they are re-exported here by name.
@@ -36,7 +36,7 @@ jobs:
           token: ${{ secrets.TRUNK_PROD_ORG_API_TOKEN }}
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -113,7 +113,7 @@ jobs:
 
   build-ruby-gem:
     name: Build Ruby gem
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     # Also runs when `test-ruby-gem-uploads` is wanted: it consumes this gem.
     if: >-
@@ -179,7 +179,7 @@ jobs:
 
   test-ruby-gem-uploads:
     name: Test Ruby gem uploads
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [build-ruby-gem, dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -245,7 +245,7 @@ jobs:
 
   gate:
     name: rspec Gate
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     # Branch-protection fan-in: one stable required context for this whole workflow.
     # A matrix job skipped by its job-level `if:` reports a single check run under the
diff --git a/.github/workflows/smoke_test.yml b/.github/workflows/smoke_test.yml
index 82adc4ce..b3580c0c 100644
--- a/.github/workflows/smoke_test.yml
+++ b/.github/workflows/smoke_test.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   determine_releases:
     name: Determine Release Versions
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     outputs:
       release: ${{ steps.set-releases.outputs.release }}
       rspec_release: ${{ steps.set-releases.outputs.rspec_release }}
@@ -128,7 +128,7 @@ jobs:
 
   download_ruby_gem:
     name: Download Ruby gem from release
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: determine_releases
     steps:
       - name: Checkout
@@ -154,7 +154,7 @@ jobs:
 
   test_ruby_gem_staging:
     name: Test Ruby gem on staging
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: download_ruby_gem
     steps:
       - name: Checkout
@@ -181,7 +181,7 @@ jobs:
 
   test_ruby_gem_production:
     name: Test Ruby gem on production
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: download_ruby_gem
     steps:
       - name: Checkout
@@ -213,7 +213,7 @@ jobs:
       - build_cli
       - test_ruby_gem_production
       - determine_releases
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     permissions:
       actions: read
     env:
@@ -243,7 +243,7 @@ jobs:
       - build_cli
       - test_ruby_gem_staging
       - determine_releases
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     permissions:
       actions: read
     env:
diff --git a/.github/workflows/smoke_test_main.yml b/.github/workflows/smoke_test_main.yml
index 5cf467ff..89bc970a 100644
--- a/.github/workflows/smoke_test_main.yml
+++ b/.github/workflows/smoke_test_main.yml
@@ -143,7 +143,7 @@ jobs:
 
   build_ruby_gem:
     name: Build Ruby gem from main
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     outputs:
       version-with-sha: ${{ steps.get-sha.outputs.version-with-sha }}
     steps:
@@ -207,7 +207,7 @@ jobs:
 
   test_ruby_gem_staging:
     name: Test Ruby gem on staging
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: build_ruby_gem
     steps:
       - name: Checkout
@@ -237,7 +237,7 @@ jobs:
 
   test_ruby_gem_production:
     name: Test Ruby gem on production
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: build_ruby_gem
     steps:
       - name: Checkout
@@ -272,7 +272,7 @@ jobs:
       - build_cli
       - test_cli
       - test_ruby_gem_production
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     permissions:
       actions: read
     env:
@@ -302,7 +302,7 @@ jobs:
       - build_cli
       - test_cli
       - test_ruby_gem_staging
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     permissions:
       actions: read
     env:
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
index f77f8ace..be64a130 100644
--- a/.github/workflows/wasm.yml
+++ b/.github/workflows/wasm.yml
@@ -19,7 +19,7 @@ jobs:
   # pull_request -- push (main), tags and dispatch run everything outright.
   dynamic-ci-filter:
     name: Dynamic CI Filter
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     if: github.event_name == 'pull_request'
     # Per-job outputs are set at runtime, so they are re-exported here by name.
@@ -34,7 +34,7 @@ jobs:
           token: ${{ secrets.TRUNK_PROD_ORG_API_TOKEN }}
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     needs: [dynamic-ci-filter]
     if: >-
       !cancelled() &&
@@ -91,7 +91,7 @@ jobs:
 
   gate:
     name: context-js Gate
-    runs-on: ubuntu-latest
+    runs-on: "${{ vars.CI_RUNNER_OVERRIDE == 'hosted' && 'ubuntu-latest' || format('trunk-staging={0}-{1}..size=medium..memory=high', github.run_id, github.run_attempt) }}"
     timeout-minutes: 5
     # Branch-protection fan-in: one stable required context for this whole workflow.
     # A matrix job skipped by its job-level `if:` reports a single check run under the