diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4aaddb6..919c1e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,18 +1,20 @@
 name: ci
 
+# main is covered by images.yml, which calls this workflow before publishing. A
+# push trigger here would start a twin run on the same ref (see concurrency).
 on:
-  push:
-    branches: [main]
   pull_request:
   workflow_call:
 
 permissions:
   contents: read
 
-# Cancel superseded runs on the same ref instead of queueing them.
+# Cancel superseded PR runs on the same ref. In a called run github.workflow is
+# the caller's name, so the images run gets its own group and is never cancelled;
+# images.yml serializes pushes to main itself.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 # Bound CPU kernel dispatch to AVX2, the dev-host golden baseline.
 env:
@@ -23,7 +25,7 @@ env:
 jobs:
   # Format, lint and types only. Fast, high signal, no test execution.
   lint:
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -49,7 +51,7 @@ jobs:
   # is a fraction of the serial run. The native-systemd-only cases are excluded here
   # and run in the nightly heavy workflow (heavy.yml).
   test:
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 25
     strategy:
       fail-fast: false
@@ -108,7 +110,7 @@ jobs:
 
   # The slow subprocess suites, in parallel with test.
   test-slow:
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 25
     strategy:
       fail-fast: false
diff --git a/.github/workflows/heavy.yml b/.github/workflows/heavy.yml
index 6073c70..b0c8290 100644
--- a/.github/workflows/heavy.yml
+++ b/.github/workflows/heavy.yml
@@ -125,9 +125,11 @@ jobs:
       - run: docker build -f docker/Dockerfile.server -t hypertrain:local .
       - run: ENGINE=docker bash scripts/canary.sh
 
+  # The serial suite peaks near 19 GB RSS (tests/auditor/test_od_bisect.py), more
+  # than a 16 GB hosted runner holds; 16 vCPU / 62 GB Blacksmith runner.
   full-suite:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 150
+    runs-on: blacksmith-16vcpu-ubuntu-2404
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 4cff028..4a9aed0 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -23,6 +23,11 @@ jobs:
   publish:
     if: github.ref == 'refs/heads/main'
     needs: ci
+    # GitHub-hosted on purpose: this job creates the build provenance, and a Blacksmith runner is
+    # recorded as runnerEnvironment=self-hosted, which `gh attestation verify
+    # --deny-self-hosted-runners` rejects (Cortex verifies its own images that way). The images
+    # published so far are runnerEnvironment=github-hosted; keep that property for a digest that
+    # may be pinned in a registry. The `ci` job above (its first line) stays on Blacksmith.
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     strategy: