diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index bbfd03d..d0026a3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     timeout-minutes: 10
     container: node:22-slim
 
diff --git a/.github/workflows/dual-approval.yaml b/.github/workflows/dual-approval.yaml
index 81b55ff..8e5c41b 100644
--- a/.github/workflows/dual-approval.yaml
+++ b/.github/workflows/dual-approval.yaml
@@ -14,7 +14,7 @@ on:
 jobs:
   promotion-gate:
     name: Promotion Gate
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     container: ubuntu:latest
     timeout-minutes: 5
 
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index efa0500..732dd52 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 jobs:
   renovate:
-    runs-on: ubuntu-latest
+    runs-on: runners-privilegedescalation
     steps:
       - uses: actions/checkout@v4
       - uses: renovatebot/github-action@v40.3.0