diff --git a/.github/workflows/bot-blocking-gate.yml b/.github/workflows/bot-blocking-gate.yml
index d2772ac..48fd719 100644
--- a/.github/workflows/bot-blocking-gate.yml
+++ b/.github/workflows/bot-blocking-gate.yml
@@ -100,7 +100,7 @@ concurrency:
 
 jobs:
   gate:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, ARM64, rpi]
     timeout-minutes: 10
     steps:
       - name: Resolve PR head SHA + fork status
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index a178a1b..49b3851 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -13,7 +13,8 @@ jobs:
   # a no-op (the review job is skipped), so it is safe to merge before the token
   # exists.
   secrets-gate:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, ARM64, rpi]
+    timeout-minutes: 5
     permissions: {}
     outputs:
       ok: ${{ steps.check.outputs.ok }}
@@ -32,7 +33,7 @@ jobs:
   claude-review:
     needs: secrets-gate
     if: ${{ needs.secrets-gate.outputs.ok == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, ARM64, rpi]
     timeout-minutes: 30
     permissions:
       contents: read