diff --git a/.github/workflows/napi-build.yml b/.github/workflows/napi-build.yml
index db61dee..34e312d 100644
--- a/.github/workflows/napi-build.yml
+++ b/.github/workflows/napi-build.yml
@@ -157,7 +157,10 @@ jobs:
   publish:
     name: Publish to npm
     needs: [test]
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore
+    # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner
+    # migration here is what killed the truffle-v0.7.10 release.
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 2883b2d..9545af5 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -21,7 +21,10 @@ jobs:
   publish:
     name: Publish crates
     needs: preflight
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore
+    # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner
+    # migration here is what killed the truffle-v0.7.10 release.
+    runs-on: ubuntu-latest
     environment: release
     env:
       # cargo publish verifies packaged crates by compiling them. The GitHub
diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
index f6df584..b26a31b 100644
--- a/.github/workflows/release-npm.yml
+++ b/.github/workflows/release-npm.yml
@@ -21,7 +21,10 @@ jobs:
   publish:
     name: Publish @vibecook/truffle
     needs: preflight
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore
+    # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner
+    # migration here is what killed the truffle-v0.7.10 release.
+    runs-on: ubuntu-latest
     permissions:
       # Draft assets are hidden from read-only workflow tokens.
       contents: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b0ccb8f..e364bb1 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -17,7 +17,9 @@ concurrency:
 
 jobs:
   release-please:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # The whole release train stays on GitHub-hosted runners — see the
+    # provenance notes on the publish jobs it gates and dispatches.
+    runs-on: ubuntu-latest
     timeout-minutes: 120
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
diff --git a/.github/workflows/release-preflight.yml b/.github/workflows/release-preflight.yml
index 05e82b3..05007d9 100644
--- a/.github/workflows/release-preflight.yml
+++ b/.github/workflows/release-preflight.yml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   verify:
     name: Verify release source
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5
         with:
diff --git a/.github/workflows/release-sidecar.yml b/.github/workflows/release-sidecar.yml
index 2dcc72a..7d7c4d1 100644
--- a/.github/workflows/release-sidecar.yml
+++ b/.github/workflows/release-sidecar.yml
@@ -101,7 +101,10 @@ jobs:
     name: Publish sidecar packages to npm
     if: startsWith(github.ref, 'refs/tags/')
     needs: build
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # GitHub-hosted required: npm/crates OIDC trusted publishing and sigstore
+    # provenance reject self-hosted-class runners (incl. Blacksmith) — a runner
+    # migration here is what killed the truffle-v0.7.10 release.
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
@@ -174,7 +177,7 @@ jobs:
     name: Pin sidecar checksums
     needs: build
     if: startsWith(github.ref, 'refs/tags/')
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
@@ -223,7 +226,7 @@ jobs:
     name: Publish checksum-bound packages
     needs: [publish-npm, checksums]
     if: startsWith(github.ref, 'refs/tags/')
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ubuntu-latest
     permissions:
       actions: write
       contents: read