diff --git a/.gitea/workflows/tests.yml b/.gitea/workflows/tests.yml
index 27636d0..9c1a44e 100644
--- a/.gitea/workflows/tests.yml
+++ b/.gitea/workflows/tests.yml
@@ -16,7 +16,8 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    # Self-hosted Gitea runners are registered as internal_docker, not ubuntu-latest.
+    runs-on: internal_docker
     container:
       image: node:22.22.1
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aac8bb1..088d2e9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   portable-windows-full:
     name: Portable Windows full bundle (Node + OpenClaw pre-installed)
-    runs-on: ubuntu-latest
+    runs-on: internal_docker
     steps:
       - uses: actions/checkout@v4
 
@@ -224,7 +224,7 @@ jobs:
   publish:
     name: Publish GitHub Release
     needs: [portable-windows-full]
-    runs-on: ubuntu-latest
+    runs-on: internal_docker
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 3f478f5..d058b2e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,7 +12,8 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    # Self-hosted Gitea runners are registered as internal_docker, not ubuntu-latest.
+    runs-on: internal_docker
     container:
       image: node:22.22.1
     steps:
diff --git a/.github/workflows/track-upstream.yml b/.github/workflows/track-upstream.yml
index d364630..8220290 100644
--- a/.github/workflows/track-upstream.yml
+++ b/.github/workflows/track-upstream.yml
@@ -36,7 +36,7 @@ permissions:
 jobs:
   track:
     name: Check upstream & auto-bump
-    runs-on: ubuntu-latest
+    runs-on: internal_docker
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/tests/ci-parity.test.mjs b/tests/ci-parity.test.mjs
index 6b727d2..ab4410d 100644
--- a/tests/ci-parity.test.mjs
+++ b/tests/ci-parity.test.mjs
@@ -30,6 +30,22 @@ test('both copies of the workflow run the same thing', () => {
   assert.ok(gitea.some((s) => s.includes('--check')), 'neither copy checks the generated files');
 });
 
+test('workflows target the self-hosted runner label', () => {
+  // Gitea act_runner on our instance registers as internal_docker. ubuntu-latest
+  // queues forever because no runner claims it.
+  const workflowPaths = [
+    ['.gitea', 'workflows', 'tests.yml'],
+    ['.github', 'workflows', 'tests.yml'],
+    ['.github', 'workflows', 'release.yml'],
+    ['.github', 'workflows', 'track-upstream.yml'],
+  ];
+  for (const path of workflowPaths) {
+    const yaml = read(...path);
+    assert.match(yaml, /runs-on:\s*internal_docker/, `${path.join('/')} should use internal_docker`);
+    assert.doesNotMatch(yaml, /runs-on:\s*ubuntu-latest/, `${path.join('/')} still asks for ubuntu-latest`);
+  }
+});
+
 test('the workflow does not depend on a runner fetching setup actions', () => {
   // On a self-hosted Gitea, setup-node has to be pulled from GitHub. A node
   // container removes one thing that can be missing on a fresh runner.