diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 125808f..ed8f36d 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -84,3 +84,15 @@ python3 scripts/validate_instruction_docs.py
 python3 scripts/validate_contract.py
 python3 scripts/validate_opencode_baseline.py
 ```
+
+## CI runner selection
+
+This repository is public, so `pull_request` executes untrusted fork code.
+Every caller of a `NDDev-it-com/ci-workflows` reusable that exposes a `runner`
+input passes `runner: ubuntu-latest` explicitly, and must keep it. Several of
+those reusables default `runner` to the estate's self-hosted `amsterdam`
+label, and a default is a property of the **pinned commit**, not of this
+repository — so dropping the explicit value would let a routine pin bump route
+fork PRs onto trusted private infrastructure with no diff here to review. On
+any ci-workflows pin bump, diff `inputs.runner.default` between the old and
+new commit before merging.
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index a52e972..f7a5f65 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -26,4 +26,9 @@ jobs:
       contents: read
     uses: NDDev-it-com/ci-workflows/.github/workflows/actionlint.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
     with:
+      # Public repo: pull_request runs untrusted fork code. Pin the hosted runner
+      # explicitly — several ci-workflows reusables now default `runner` to the
+      # self-hosted `amsterdam` label, so inheriting the default on a pin bump
+      # would put fork PRs on trusted private infrastructure.
+      runner: ubuntu-latest
       post_command: python3 scripts/check_action_pins.py .github/workflows
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index e957fff..78d5a39 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -23,4 +23,9 @@ jobs:
       contents: read
     uses: NDDev-it-com/ci-workflows/.github/workflows/secret-scan.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1
     with:
+      # Public repo: pull_request runs untrusted fork code. Pin the hosted runner
+      # explicitly — several ci-workflows reusables now default `runner` to the
+      # self-hosted `amsterdam` label, so inheriting the default on a pin bump
+      # would put fork PRs on trusted private infrastructure.
+      runner: ubuntu-latest
       gitleaks_config_path: .gitleaks.toml
diff --git a/AGENTS.md b/AGENTS.md
index 5efea37..8455f4f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -192,3 +192,15 @@ python3 scripts/check_baseline_consistency.py
 python3 scripts/validate_instruction_docs.py
 python3 scripts/validate_mcp_profiles.py
 ```
+
+## CI runner selection
+
+This repository is public, so `pull_request` executes untrusted fork code.
+Every caller of a `NDDev-it-com/ci-workflows` reusable that exposes a `runner`
+input passes `runner: ubuntu-latest` explicitly, and must keep it. Several of
+those reusables default `runner` to the estate's self-hosted `amsterdam`
+label, and a default is a property of the **pinned commit**, not of this
+repository — so dropping the explicit value would let a routine pin bump route
+fork PRs onto trusted private infrastructure with no diff here to review. On
+any ci-workflows pin bump, diff `inputs.runner.default` between the old and
+new commit before merging.