diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4ffec2f5..62de3532 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   check:
     name: check
-    runs-on: ubuntu-24.04
+    runs-on: akua-docker-ci-v2
     timeout-minutes: 20
     steps:
       - name: Check out the exact revision
@@ -33,6 +33,8 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Run repository checks
+        env:
+          TMPDIR: ${{ runner.temp }}
         run: bun run check
 
       - name: Build the Cloudflare Worker
@@ -54,7 +56,7 @@ jobs:
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository
     needs: check
-    runs-on: ubuntu-24.04
+    runs-on: akua-x64-ci-v2
     timeout-minutes: 40
     steps:
       - name: Check out the exact revision
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 380eda61..56f4745a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: akua-docker-ci-v2
             platform: linux/amd64
             suffix: amd64
           - runner: ubuntu-24.04-arm
@@ -70,7 +70,7 @@ jobs:
   publish:
     name: publish immutable release
     needs: image
-    runs-on: ubuntu-24.04
+    runs-on: akua-docker-ci-v2
     timeout-minutes: 20
     steps:
       - name: Check out the released revision
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d242ff08..611efddf 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -313,8 +313,9 @@ git push origin v<semver>
 ```
 
 The [`Release`](./.github/workflows/release.yml) workflow builds the same clean
-tagged checkout on native GitHub-hosted amd64 and arm64 runners, publishes the
-two platform images, joins them into one OCI index, resolves its registry
+tagged checkout on the audited AgentOS ARC/Kata amd64 pool and a native
+GitHub-hosted arm64 runner, publishes the two platform images, joins them into
+one OCI index, resolves its registry
 digest, and renders the ordinary human-readable block YAML directly from
 Kustomize. It uploads the fixed-name scoped, cluster-admin and database
 manifests to a draft GitHub release and publishes the release only after every