diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
new file mode 100644
index 000000000..b45baef5e
--- /dev/null
+++ b/.github/workflows/ci-pr.yml
@@ -0,0 +1,13 @@
+name: CI
+
+# The PR dispatcher always calls the main-pinned workflow. That workflow
+# independently routes same-repository Linux jobs to the managed public fleet
+# and fork jobs to GitHub-hosted runners.
+on:
+  pull_request:
+
+permissions: read-all
+
+jobs:
+  run:
+    uses: kenn-io/msgvault/.github/workflows/ci.yml@main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 88646b006..859bf0e06 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,13 +4,12 @@ permissions:
   contents: read
 
 on:
+  workflow_call:
   push:
     branches: [main]
-  pull_request:
   workflow_dispatch:
   schedule:
     - cron: '23 8 * * 1'
-
 jobs:
   release-linux-smoke:
     strategy:
@@ -23,7 +22,7 @@ jobs:
           - goarch: arm64
             runner: ubuntu-24.04-arm
             go_arch_name: arm64
-    runs-on: ${{ matrix.runner }}
+    runs-on: ${{ contains(fromJSON('["ubuntu-latest","ubuntu-24.04","ubuntu-22.04"]'), matrix.runner) && github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || matrix.runner }}
     container:
       image: ubuntu:22.04
     steps:
@@ -100,7 +99,7 @@ jobs:
         run: govulncheck -tags "fts5 sqlite_vec" ./...
 
   frontend:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-24.04' }}
     container:
       image: mcr.microsoft.com/playwright:v1.61.1-noble@sha256:5b8f294aff9041b7191c34a4bab3ac270157a28774d4b0660e9743297b697e48
     steps:
@@ -157,7 +156,7 @@ jobs:
           if-no-files-found: ignore
 
   web-e2e:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-24.04' }}
     container:
       image: mcr.microsoft.com/playwright:v1.61.1-noble@sha256:5b8f294aff9041b7191c34a4bab3ac270157a28774d4b0660e9743297b697e48
     steps:
@@ -402,7 +401,7 @@ jobs:
   # tag is required; without it these files compile out and ship no tests,
   # so this code would otherwise have zero CI coverage.
   test-pgvector:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     services:
       postgres:
         image: pgvector/pgvector:pg16
@@ -441,7 +440,7 @@ jobs:
         run: go test -tags "fts5 sqlite_vec pgvector" -count=1 ./internal/vector/... ./internal/scheduler/... ./cmd/msgvault/cmd/...
 
   nix-build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
@@ -457,7 +456,7 @@ jobs:
   # unique constraints) surface here rather than slipping past a single
   # pass.
   test-postgres:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     services:
       postgres:
         image: postgres:16
diff --git a/.github/workflows/docker-pr.yml b/.github/workflows/docker-pr.yml
new file mode 100644
index 000000000..afa4bf090
--- /dev/null
+++ b/.github/workflows/docker-pr.yml
@@ -0,0 +1,26 @@
+name: Docker
+
+# The PR dispatcher always calls the main-pinned workflow. That workflow
+# independently routes same-repository Linux jobs to the managed public fleet
+# and fork jobs to GitHub-hosted runners.
+on:
+  pull_request:
+    paths:
+      - 'Dockerfile'
+      - '.dockerignore'
+      - '.github/workflows/docker.yml'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Makefile'
+      - 'api/openapi.yaml'
+      - 'pkg/client/openapi.yaml'
+      - 'scripts/generate-web-client.mjs'
+      - 'web/**'
+      - 'internal/web/**'
+      - '**/*.go'
+      - '.github/workflows/docker-pr.yml'
+permissions: read-all
+
+jobs:
+  run:
+    uses: kenn-io/msgvault/.github/workflows/docker.yml@main
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 273b66a3c..8de525e6f 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,25 +1,11 @@
 name: Docker
 
 on:
+  workflow_call:
   push:
     branches: [main]
     tags:
       - 'v*'
-  pull_request:
-    paths:
-      - 'Dockerfile'
-      - '.dockerignore'
-      - '.github/workflows/docker.yml'
-      - 'go.mod'
-      - 'go.sum'
-      - 'Makefile'
-      - 'api/openapi.yaml'
-      - 'pkg/client/openapi.yaml'
-      - 'scripts/generate-web-client.mjs'
-      - 'web/**'
-      - 'internal/web/**'
-      - '**/*.go'
-
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -28,7 +14,7 @@ jobs:
   # PR validation: build and smoke-test only, no registry access
   validate:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     permissions:
       contents: read
 
@@ -79,7 +65,7 @@ jobs:
   # Publish: build multi-arch and push to GHCR (main/tags only)
   publish:
     if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'kenn-io/msgvault' && (github.ref == 'refs/heads/main' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.base.repo.full_name == github.repository)) && 'kenn-linux-x64-public' || 'ubuntu-latest' }}
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/workflow-validation.yml b/.github/workflows/workflow-validation.yml
new file mode 100644
index 000000000..d7ff9115e
--- /dev/null
+++ b/.github/workflows/workflow-validation.yml
@@ -0,0 +1,20 @@
+name: Workflow validation
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
+        with:
+          version: 1.7.12
+          shellcheck: false
+          pyflakes: false