diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml
index 1bae7b04..814e6fc8 100644
--- a/.gitea/workflows/nightly.yml
+++ b/.gitea/workflows/nightly.yml
@@ -43,7 +43,13 @@ env:
 
 jobs:
   deploy-staging:
-    runs-on: self-hosted
+    # `ubuntu-latest` matches our self-hosted runner's advertised label
+    # (the runner has labels: ubuntu-latest / ubuntu-24.04 / ubuntu-22.04).
+    # `self-hosted` would never match — no runner advertises it — so the
+    # job parks in the queue forever. ADR-011's "single-tenant" promise
+    # is at the repo level; sharing this runner between CI and deploys
+    # for the same repo is within that boundary.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 96894fed..3831320f 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -45,7 +45,9 @@ env:
 
 jobs:
   deploy-production:
-    runs-on: self-hosted
+    # See nightly.yml — same rationale: `ubuntu-latest` matches the
+    # advertised label of our single-tenant self-hosted runner.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4