diff --git a/.github/workflows/ci-prek.yml b/.github/workflows/ci-prek.yml
index fa06eba..1bc9a56 100644
--- a/.github/workflows/ci-prek.yml
+++ b/.github/workflows/ci-prek.yml
@@ -6,65 +6,29 @@ on:
   pull_request:
     branches: [main]
 
-jobs:
-  _prek-check-self-hosted:
-    name: "Pre-commit Hooks (self-hosted)"
-    runs-on: [self-hosted, ubuntu-latest]
-    timeout-minutes: 30
-    continue-on-error: true
-    outputs:
-      passed: ${{ steps.mark.outputs.passed }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      # uvx avoids the runner's system Python; bare pip broke on the
-      # self-hosted runner's damaged cached 3.11 toolchain.
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-        with:
-          enable-cache: true
-
-      - name: Run prek
-        run: uvx prek run --all-files
-
-      - name: Validate .rules.ts
-        run: bash scripts/validate-rules.sh
-
-      - name: Archgate structural check
-        run: bash scripts/archgate.sh structural .rules.ts
-
-      - id: mark
-        if: success()
-        run: echo "passed=true" >> "$GITHUB_OUTPUT"
+permissions:
+  contents: read
 
+jobs:
   prek-check:
     name: Pre-commit Hooks
-    needs: _prek-check-self-hosted
-    if: always()
     runs-on: ubuntu-latest
     steps:
-      - name: Route
-        run: echo "passed=${{ needs._prek-check-self-hosted.outputs.passed }}"
-
       - name: Checkout
-        if: needs._prek-check-self-hosted.outputs.passed != 'true'
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        if: needs._prek-check-self-hosted.outputs.passed != 'true'
         uses: astral-sh/setup-uv@v4
         with:
           enable-cache: true
 
       - name: Run prek
-        if: needs._prek-check-self-hosted.outputs.passed != 'true'
         run: uvx prek run --all-files
 
       - name: Validate .rules.ts
-        if: needs._prek-check-self-hosted.outputs.passed != 'true'
         run: bash scripts/validate-rules.sh
 
       - name: Archgate structural check
-        if: needs._prek-check-self-hosted.outputs.passed != 'true'
         run: bash scripts/archgate.sh structural .rules.ts
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a3697f5..210937d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,51 +6,23 @@ on:
   pull_request:
     branches: [main]
 
-jobs:
-  _lint-self-hosted:
-    name: "lint (self-hosted)"
-    runs-on: [self-hosted, ubuntu-latest]
-    timeout-minutes: 30
-    continue-on-error: true
-    outputs:
-      passed: ${{ steps.mark.outputs.passed }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v4
-        with:
-          enable-cache: true
-      - run: uv sync
-      - name: Ruff lint
-        run: uv run ruff check src/ tests/
-      - name: Ruff format check
-        run: uv run ruff format --check src/ tests/
-      - name: MyPy typecheck
-        run: uv run mypy src/ --ignore-missing-imports
-      - id: mark
-        if: success()
-        run: echo "passed=true" >> "$GITHUB_OUTPUT"
+permissions:
+  contents: read
 
+jobs:
   lint:
-    needs: _lint-self-hosted
-    if: always()
     runs-on: ubuntu-latest
     steps:
-      - name: Route
-        run: echo "passed=${{ needs._lint-self-hosted.outputs.passed }}"
       - uses: actions/checkout@v4
-        if: needs._lint-self-hosted.outputs.passed != 'true'
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@v4
-        if: needs._lint-self-hosted.outputs.passed != 'true'
         with:
           enable-cache: true
       - run: uv sync
-        if: needs._lint-self-hosted.outputs.passed != 'true'
       - name: Ruff lint
-        if: needs._lint-self-hosted.outputs.passed != 'true'
         run: uv run ruff check src/ tests/
       - name: Ruff format check
-        if: needs._lint-self-hosted.outputs.passed != 'true'
         run: uv run ruff format --check src/ tests/
       - name: MyPy typecheck
-        if: needs._lint-self-hosted.outputs.passed != 'true'
         run: uv run mypy src/ --ignore-missing-imports
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d68818d..1fb2bde 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,138 +6,55 @@ on:
   pull_request:
     branches: [main]
 
-jobs:
-  _test-self-hosted:
-    name: "test (self-hosted)"
-    runs-on: [self-hosted, ubuntu-latest]
-    timeout-minutes: 30
-    # Self-hosted is the preferred leg; the canonical job falls back to a
-    # GitHub-hosted runner when it fails, so a failure here must not fail
-    # the overall run.
-    continue-on-error: true
-    strategy:
-      matrix:
-        python-version: ["3.12", "3.13"]
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Install UV
-        uses: astral-sh/setup-uv@v4
-        with:
-          enable-cache: true
-
-      - name: Install dependencies
-        run: uv sync
-
-      - name: Run unit tests
-        run: uv run pytest tests/unit/ -v --tb=short
-
-      - name: Run with Python 3.12 only (lint + typecheck)
-        if: matrix.python-version == '3.12'
-        run: |
-          uv run ruff check src/ tests/
-          uv run mypy src/ --ignore-missing-imports
-
-  _test-gate:
-    name: "test (gate)"
-    needs: _test-self-hosted
-    if: always()
-    runs-on: ubuntu-latest
-    outputs:
-      passed: ${{ steps.mark.outputs.passed }}
-    steps:
-      - id: mark
-        if: needs._test-self-hosted.result == 'success'
-        run: echo "passed=true" >> "$GITHUB_OUTPUT"
+permissions:
+  contents: read
 
+jobs:
   test:
-    needs: _test-gate
-    if: always()
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.12", "3.13"]
 
     steps:
-      - name: Route
-        run: echo "passed=${{ needs._test-gate.outputs.passed }}"
-
       - uses: actions/checkout@v4
-        if: needs._test-gate.outputs.passed != 'true'
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        if: needs._test-gate.outputs.passed != 'true'
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install UV
-        if: needs._test-gate.outputs.passed != 'true'
         uses: astral-sh/setup-uv@v4
         with:
           enable-cache: true
 
       - name: Install dependencies
-        if: needs._test-gate.outputs.passed != 'true'
         run: uv sync
 
       - name: Run unit tests
-        if: needs._test-gate.outputs.passed != 'true'
         run: uv run pytest tests/unit/ -v --tb=short
 
       - name: Run with Python 3.12 only (lint + typecheck)
-        if: needs._test-gate.outputs.passed != 'true' && matrix.python-version == '3.12'
+        if: matrix.python-version == '3.12'
         run: |
           uv run ruff check src/ tests/
           uv run mypy src/ --ignore-missing-imports
 
-  _smoke-self-hosted:
-    name: "smoke (self-hosted)"
-    runs-on: [self-hosted, ubuntu-latest]
-    timeout-minutes: 30
-    continue-on-error: true
-    outputs:
-      passed: ${{ steps.mark.outputs.passed }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - uses: astral-sh/setup-uv@v4
-      - run: uv sync
-      - name: CLI smoke test
-        run: |
-          uv run kontor-cli --help
-          uv run kontor-cli check-config 2>&1 | grep -q "Config error" || echo "check-config runs"
-      - id: mark
-        if: success()
-        run: echo "passed=true" >> "$GITHUB_OUTPUT"
-
   smoke:
-    needs: _smoke-self-hosted
-    if: always()
     runs-on: ubuntu-latest
     steps:
-      - name: Route
-        run: echo "passed=${{ needs._smoke-self-hosted.outputs.passed }}"
       - uses: actions/checkout@v4
-        if: needs._smoke-self-hosted.outputs.passed != 'true'
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
-        if: needs._smoke-self-hosted.outputs.passed != 'true'
         with:
           python-version: "3.12"
       - uses: astral-sh/setup-uv@v4
-        if: needs._smoke-self-hosted.outputs.passed != 'true'
       - run: uv sync
-        if: needs._smoke-self-hosted.outputs.passed != 'true'
       - name: CLI smoke test
-        if: needs._smoke-self-hosted.outputs.passed != 'true'
         run: |
           uv run kontor-cli --help
           uv run kontor-cli check-config 2>&1 | grep -q "Config error" || echo "check-config runs"