diff --git a/.github/workflows/allow-deploys.yml b/.github/workflows/allow-deploys.yml
index 5f4e213..8dc8f07 100644
--- a/.github/workflows/allow-deploys.yml
+++ b/.github/workflows/allow-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   allow-release:
     name: Allow release
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/block-deploys.yml b/.github/workflows/block-deploys.yml
index aff3603..a698c81 100644
--- a/.github/workflows/block-deploys.yml
+++ b/.github/workflows/block-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   disable-deploy-flows:
     name: Disable and cancel deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/component-deploy-v2.yml b/.github/workflows/component-deploy-v2.yml
index 4d91c54..352c48d 100644
--- a/.github/workflows/component-deploy-v2.yml
+++ b/.github/workflows/component-deploy-v2.yml
@@ -84,7 +84,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/component-deploy.yml b/.github/workflows/component-deploy.yml
index eed3807..a4f965f 100644
--- a/.github/workflows/component-deploy.yml
+++ b/.github/workflows/component-deploy.yml
@@ -72,7 +72,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 20
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/create-release-tag.yml b/.github/workflows/create-release-tag.yml
index 9666908..51a08b6 100644
--- a/.github/workflows/create-release-tag.yml
+++ b/.github/workflows/create-release-tag.yml
@@ -12,7 +12,7 @@ on:
 jobs:
   create-tag:
     name: Create Release Tag
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/deploy-generic-v2.yml b/.github/workflows/deploy-generic-v2.yml
index fd284bb..fb47c14 100644
--- a/.github/workflows/deploy-generic-v2.yml
+++ b/.github/workflows/deploy-generic-v2.yml
@@ -149,7 +149,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-generic.yml b/.github/workflows/deploy-generic.yml
index ea29094..0d23b61 100644
--- a/.github/workflows/deploy-generic.yml
+++ b/.github/workflows/deploy-generic.yml
@@ -140,7 +140,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-kotlin-v2.yml b/.github/workflows/deploy-kotlin-v2.yml
index 755b088..657cf22 100644
--- a/.github/workflows/deploy-kotlin-v2.yml
+++ b/.github/workflows/deploy-kotlin-v2.yml
@@ -328,7 +328,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-kotlin.yml b/.github/workflows/deploy-kotlin.yml
index dc55b3c..ee71c18 100644
--- a/.github/workflows/deploy-kotlin.yml
+++ b/.github/workflows/deploy-kotlin.yml
@@ -313,7 +313,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-python.yml b/.github/workflows/deploy-python.yml
index 3555ec3..7eccc29 100644
--- a/.github/workflows/deploy-python.yml
+++ b/.github/workflows/deploy-python.yml
@@ -100,7 +100,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/pr-digest.yml b/.github/workflows/pr-digest.yml
index 86547b2..6a94422 100644
--- a/.github/workflows/pr-digest.yml
+++ b/.github/workflows/pr-digest.yml
@@ -69,7 +69,7 @@ permissions:
 jobs:
   digest:
     name: Build and post PR digest
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/publish-tech-docs.yml b/.github/workflows/publish-tech-docs.yml
index 52f3416..2d02535 100644
--- a/.github/workflows/publish-tech-docs.yml
+++ b/.github/workflows/publish-tech-docs.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   publish-techdocs-site:
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
 
     env:
       TECHDOCS_S3_BUCKET_NAME: 'monta-tech-docs'
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index dc38a6f..8337bbe 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   lint-workflows:
     name: Lint GitHub Workflows
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 3db0ca0..4917c7b 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -51,7 +51,7 @@ jobs:
   slackNotification:
     name: Send Slack notification
     if: ${{ !inputs.dry-run }}
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - name: Slack Notification
@@ -79,7 +79,7 @@ jobs:
     needs: block-deploys
     if: ${{ !cancelled() && (needs.block-deploys.result == 'success' || needs.block-deploys.result == 'skipped') }}
     name: Deploy rollback
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/semgrep-security-scan.yml b/.github/workflows/semgrep-security-scan.yml
index 643ab48..59c103a 100644
--- a/.github/workflows/semgrep-security-scan.yml
+++ b/.github/workflows/semgrep-security-scan.yml
@@ -20,7 +20,7 @@ on:
 jobs:
   semgrep:
     name: Security Scan
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-4cpu-12gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     permissions:
       contents: read
diff --git a/.github/workflows/track-pending-release.yml b/.github/workflows/track-pending-release.yml
index 5cd90b2..38e4e64 100644
--- a/.github/workflows/track-pending-release.yml
+++ b/.github/workflows/track-pending-release.yml
@@ -17,7 +17,7 @@ on:
 jobs:
   update-pending-release:
     name: Update Pending Release Changelog
-    runs-on: linux-arm64
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -75,7 +75,7 @@ jobs:
           MAIN="${{ steps.get-main.outputs.main-sha }}"
 
           # Get commits between deployed and main
-          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [`\(.sha[0:7])`](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
+          COMMITS=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.commits[] | "- [\u0060\(.sha[0:7])\u0060](\(.html_url)) \(.commit.message | split("\n")[0]) by @\(.author.login // "unknown")"')
 
           # Count commits
           COMMIT_COUNT=$(gh api "repos/${{ github.repository }}/compare/${DEPLOYED}...${MAIN}" --jq '.total_commits')
diff --git a/CLAUDE.md b/CLAUDE.md
index ed530f8..3fa88b1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,9 +1,12 @@
 # Claude Code Notes
 
 ## Last Documentation Update
-- **Date**: 2026-10-05
-- **Latest SHA**: 4491679 (check for newer commits)
-- **Changes**: Removed Blacksmith runner support
+- **Date**: 2026-10-06
+- **Latest SHA**: 340af8f (check for newer commits)
+- **Changes**: The shared workflows' own jobs run on ARC in private repositories
+
+## Recent Changes (2026-10-06)
+1. **The shared workflows' own jobs run on ARC**: the 17 jobs that named a GitHub-hosted label (`component-deploy(-v2)` deploy, `create-release-tag`, the deploy workflows' changelog and Slack-token deprecation jobs, `rollback`, `track-pending-release`, `pr-digest`, `publish-tech-docs`, `allow-/block-deploys`, `semgrep-security-scan`, and this repo's own `pull-request.yml`) use `${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}`; semgrep gets `arc-arm64-4cpu-12gb`. Public callers, and events without a repository in the payload (`schedule`), get GitHub's standard arm64 runner. The deploy and rollback jobs rely on `yq` v4 and `jq` from the runner, both in the ARC image; `argocd` is downloaded by `argocd-wait-sync`, and nothing calls the `helm` CLI.
 
 ## Recent Changes (2026-10-05)
 1. **Blacksmith runner support removed**: the `use-blacksmith-runners` input is gone from every workflow and from `runner-size-converter`, `component-build` no longer has the `build-blacksmith` job (`build-self-hosted` always runs), and the Blacksmith labels are out of `actionlint.yaml`. The converter now resolves ARC (`use-arc-runners: true` in a private repo), `ubuntu-24.04-arm` (public repo), or else the GitHub-hosted `linux-arm64` / `linux-arm64-xl`; that last case covers callers that opt out of ARC and events without a repository in the payload (`schedule`), which previously fell back to Blacksmith. Callers that still pass `use-blacksmith-runners` fail at startup; changelog-monorepo and service-productops dropped it first. Repos pinned to an older github-workflows SHA keep that SHA's behaviour, and the seven pinned to `f0866ab` (Blacksmith by default) were bumped to `4491679`.
diff --git a/README.md b/README.md
index 67dadc0..14e367f 100644
--- a/README.md
+++ b/README.md
@@ -295,7 +295,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
diff --git a/docs/workflow-guide.md b/docs/workflow-guide.md
index 330d876..78446e5 100644
--- a/docs/workflow-guide.md
+++ b/docs/workflow-guide.md
@@ -1243,7 +1243,7 @@ on:
 
 jobs:
   schedule-guard:
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     outputs:
       proceed: ${{ steps.check.outputs.proceed }}
     steps:
@@ -1392,7 +1392,7 @@ jobs:
   terraform-ok:
     needs: [discover, terraform]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-arm64-2cpu-4gb
     steps:
       - run: |
           [[ "${{ needs.discover.result }}" == "success" ]] || exit 1