diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index cd9183b..4dcd67f 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -2,3 +2,5 @@ self-hosted-runner:
   labels:
     # non-root ephemeral exec runner for our own code
     - truecopy-exec
+    # read-tier runner for the fleet status job, outside the exec cap
+    - fleet-status
diff --git a/.github/workflows/fleet-status-self-test.yml b/.github/workflows/fleet-status-self-test.yml
index 9a698ed..a3dc2c0 100644
--- a/.github/workflows/fleet-status-self-test.yml
+++ b/.github/workflows/fleet-status-self-test.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: askalf/ci/actions/fleet-status-check@4365d12f956b60e795b5b55451e2035549a3600c # main 2026-11-01, askalf/ci#153
+      - uses: askalf/ci/actions/fleet-status-check@8b4fc27416783ad2528fe29086b3df4f85005673 # main 2026-11-01, askalf/ci#156
         with:
           min-own-exprs: '5'
           repo-only: fleet-status.yml fleet-status-backfill.yml marketplace-watch.yml
diff --git a/.github/workflows/fleet-status.yml b/.github/workflows/fleet-status.yml
index dea7382..1df3f6e 100644
--- a/.github/workflows/fleet-status.yml
+++ b/.github/workflows/fleet-status.yml
@@ -55,11 +55,12 @@ jobs:
          github.event.workflow_run.head_repository.full_name != github.repository))) ||
       (github.event_name != 'issue_comment' && github.event_name != 'workflow_run' &&
        github.event.pull_request.head.repo.full_name == github.repository)
-    # On our runner for every event here, a fork PR's included: the job runs the pinned fleet-status
-    # action and never PR code (see above), so GitHub's hosted queue going down does not hold the
-    # fleet/verify and fleet/review statuses a merge waits on. A fork repository has no
-    # truecopy-exec runners, so there it runs on GitHub's.
-    runs-on: ${{ github.repository == 'askalf/truecopy' && fromJSON('["self-hosted","truecopy-exec"]') || 'ubuntu-latest' }}
+    # On our runner for every event, a fork's included: the job runs the pinned fleet-status action
+    # and never PR code (see above), so GitHub's hosted queue going down does not hold the fleet/verify
+    # and fleet/review statuses a merge waits on. The runner is this repository's fleet status row
+    # (label fleet-status), a read-tier row: this few-second job holds no exec cap slot that a test
+    # job waits for. A fork repository has no fleet-status runners, so there it runs on GitHub's.
+    runs-on: ${{ github.repository == 'askalf/truecopy' && fromJSON('["self-hosted","fleet-status"]') || 'ubuntu-latest' }}
     timeout-minutes: 5
     permissions:
       contents: read