diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 25146e0..0cb0aa6 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   build-checks:
-    runs-on: ubuntu-latest
+    runs-on: alta-tool-hub-ci
     permissions:
       contents: read
     steps:
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
index f26198a..6d20ba2 100644
--- a/test/build-contract.test.js
+++ b/test/build-contract.test.js
@@ -56,8 +56,10 @@ test('build remains Windows portable without misleading signing overrides', () =
   assert.match(pkg.scripts.check, /verify-kit/);
 });
 
-test('GitPeji CI is build-only and runs all hardening gates on Node 22', () => {
+test('GitPeji CI targets the live runner and is build-only on Node 22', () => {
   const workflow = read('.gitea/workflows/ci.yml');
+  assert.match(workflow, /^\s*runs-on:\s*alta-tool-hub-ci\s*$/m);
+  assert.doesNotMatch(workflow, /^\s*runs-on:\s*ubuntu-latest\s*$/m);
   assert.match(workflow, /actions\/checkout@v4/);
   assert.match(workflow, /actions\/setup-node@v4/);
   assert.match(workflow, /node-version:\s*['"]?22['"]?/);