diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0bbc72..9b5ee0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,8 @@ env:
 jobs:
   lint:
     name: Lint
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    # GitHub-hosted runner (org rule: private repos on Ubicloud, public on GitHub-hosted).
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
@@ -56,7 +57,7 @@ jobs:
   # 4 vCPU: the suite is CPU-bound and scales with workers.
   test:
     name: Tests
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v6
@@ -107,7 +108,7 @@ jobs:
   # parallel rather than after it keeps wall-clock at max(job), not sum(jobs).
   package:
     name: Build & CLI Smoke Test
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event_name == 'pull_request'
     steps:
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 24da209..c872e27 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -27,7 +27,8 @@ permissions:
 jobs:
   build-and-push:
     name: Build and Push Docker Image
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    # GitHub-hosted runner (org rule: private repos on Ubicloud, public on GitHub-hosted).
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/publish-test.yml b/.github/workflows/publish-test.yml
index 39055a9..e402fe1 100644
--- a/.github/workflows/publish-test.yml
+++ b/.github/workflows/publish-test.yml
@@ -19,7 +19,8 @@ permissions:
 jobs:
   build-and-publish:
     name: Build and Publish to TestPyPI
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # GitHub-hosted runner (org rule: private repos on Ubicloud, public on GitHub-hosted).
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: test-release  # Optional: add environment protection
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f702473..d0ad796 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,7 +16,8 @@ permissions:
 jobs:
   verify:
     name: Verify Version Consistency
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    # GitHub-hosted runner (org rule: private repos on Ubicloud, public on GitHub-hosted).
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
       version: ${{ steps.get_version.outputs.version }}
@@ -79,7 +80,7 @@ jobs:
 
   test:
     name: Run Tests
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     needs: verify
     steps:
@@ -101,7 +102,7 @@ jobs:
 
   build:
     name: Build Package
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: [verify, test]
     steps:
@@ -129,7 +130,7 @@ jobs:
 
   create-release:
     name: Create GitHub Release
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: [verify, build]
     steps:
@@ -182,7 +183,7 @@ jobs:
 
   publish-pypi:
     name: Publish to PyPI
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     needs: [verify, build, create-release]
     environment: pypi
diff --git a/CLAUDE.md b/CLAUDE.md
index 9c8f817..496aeb8 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -711,7 +711,7 @@ Releases go direct-to-main under the same owner bypass — a "pull request requi
 
 ## CI standard
 
-- CI runs on Blacksmith (`blacksmith-2vcpu-ubuntu-2404`; `publish-test` on 4vcpu — deliberate). Every workflow declares a `concurrency` group with cancel-in-progress, and every job sets `timeout-minutes`. Publish workflows (PyPI / TestPyPI / Docker tag) are hard `cancel-in-progress: false` — publishes are irreversible.
+- CI runs on GitHub-hosted runners (`ubuntu-latest`; public repo — org rule: private on Ubicloud, public on GitHub-hosted). Every workflow declares a `concurrency` group with cancel-in-progress, and every job sets `timeout-minutes`. Publish workflows (PyPI / TestPyPI / Docker tag) are hard `cancel-in-progress: false` — publishes are irreversible.
 
 ### The local gate is the CI gate