diff --git a/.github/workflows/fleet-review-relay.yml b/.github/workflows/fleet-review-relay.yml
index dae2fd0..0e13893 100644
--- a/.github/workflows/fleet-review-relay.yml
+++ b/.github/workflows/fleet-review-relay.yml
@@ -14,7 +14,7 @@ permissions: {}
 
 jobs:
   relay:
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.repository != 'askalf/browser-bridge' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","browser-bridge-exec"]') }}
     timeout-minutes: 2
     steps:
       - name: Hand the review to fleet-status.yml
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index e84eecb..20f711a 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -38,7 +38,7 @@ jobs:
     name: Fuzz (Jazzer.js)
     # Never from a fork: the schedule is inherited by every fork and means nothing there.
     if: github.repository == 'askalf/browser-bridge'
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.repository != 'askalf/browser-bridge' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","browser-bridge-exec"]') }}
     timeout-minutes: 40
     steps:
       - uses: askalf/ci/actions/checkout-with-retry@9718a75899ff8774d5f6b8135ffb067fabe9dc24 # main 2026-10-29, askalf/ci#139
diff --git a/.github/workflows/pr-triage.yml b/.github/workflows/pr-triage.yml
index 4341adb..dfddfdb 100644
--- a/.github/workflows/pr-triage.yml
+++ b/.github/workflows/pr-triage.yml
@@ -22,7 +22,7 @@ concurrency:
 jobs:
   triage:
     name: triage
-    runs-on: ubuntu-latest
+    runs-on: ${{ (github.repository != 'askalf/browser-bridge' || github.event.pull_request && (github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.user.login == 'dependabot[bot]')) && 'ubuntu-latest' || fromJSON('["self-hosted","browser-bridge-exec"]') }}
     timeout-minutes: 5
     permissions:
       contents: read