diff --git a/.github/workflows/auto-fmt.yml b/.github/workflows/auto-fmt.yml
index f60d3ad2..8912e3e0 100644
--- a/.github/workflows/auto-fmt.yml
+++ b/.github/workflows/auto-fmt.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   auto-format:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 510a7489..2758f65e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   fmt:
     name: Check formatting
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -31,7 +31,7 @@ jobs:
   # API on stable (libFuzzer/nightly is only needed to actually *run* them).
   fuzz-check:
     name: Fuzz targets compile
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     steps:
       - uses: actions/checkout@v4
@@ -50,7 +50,7 @@ jobs:
 
   clippy-and-test:
     name: Build, Test, Clippy
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     # This job compiles the workspace three times (debug, release, and a third
     # release build for the panic=abort assert), runs the full workspace test
@@ -139,7 +139,7 @@ jobs:
     name: Integration Tests
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [blacksmith-4vcpu-ubuntu-2404, blacksmith-4vcpu-windows-2025]
     runs-on: ${{ matrix.os }}
     needs: fmt
     # The password-hashing tests exercise deliberately slow, memory/CPU-hard
@@ -240,7 +240,7 @@ jobs:
   # `cargo test`; this job exercises the env-gated PostgreSQL/MariaDB paths.
   database-tests:
     name: Database Tests (PostgreSQL + MariaDB)
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: fmt
     timeout-minutes: 15
     services:
@@ -291,7 +291,7 @@ jobs:
     name: Run WFL Programs
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [blacksmith-4vcpu-ubuntu-2404, blacksmith-4vcpu-windows-2025]
     runs-on: ${{ matrix.os }}
     needs: fmt
     timeout-minutes: 20
@@ -554,7 +554,7 @@ jobs:
   # so API drift that breaks the fuzz targets blocks the post-merge version bump.
   bump-version:
     name: Bump Version
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [fmt, fuzz-check, clippy-and-test, integration-tests, database-tests, run-wfl-programs]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index b5e8cfd4..27df7610 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -18,7 +18,7 @@ jobs:
     #   github.event.pull_request.user.login == 'new-developer' ||
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 6b15fac7..a8ac542e 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -17,7 +17,7 @@ jobs:
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8302d126..9fcc8d90 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -28,7 +28,7 @@ permissions:
 jobs:
   check-for-changes:
     name: Check for changes since last nightly build
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       should_build: ${{ steps.check.outputs.should_build }}
       version:      ${{ steps.version.outputs.version }}
@@ -122,7 +122,7 @@ jobs:
     name: Build WFL for Windows
     needs: check-for-changes
     if: needs.check-for-changes.outputs.should_build == 'true'
-    runs-on: windows-latest
+    runs-on: blacksmith-4vcpu-windows-2025
     # `cargo test --release` here compiles EVERY integration test binary in
     # tests/ (112 of them as of 26.7.49) against the full dependency graph, in
     # release mode with `[profile.release] debug = true` — so each one also links
@@ -440,7 +440,7 @@ jobs:
     name: Create or Update Nightly Release
     needs: [check-for-changes, build]
     if: needs.check-for-changes.outputs.should_build == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
       contents: write
diff --git a/.github/workflows/update-security-doc.yml b/.github/workflows/update-security-doc.yml
index a2aaffe9..2727258e 100644
--- a/.github/workflows/update-security-doc.yml
+++ b/.github/workflows/update-security-doc.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   update-security:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/versioning.yml b/.github/workflows/versioning.yml
index 2e5a6992..6d14ca86 100644
--- a/.github/workflows/versioning.yml
+++ b/.github/workflows/versioning.yml
@@ -5,7 +5,7 @@ on:
 
 jobs:
   bump-version:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/wfl-config-lint.yml b/.github/workflows/wfl-config-lint.yml
index 3fc911e0..5c839bbc 100644
--- a/.github/workflows/wfl-config-lint.yml
+++ b/.github/workflows/wfl-config-lint.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   config-lint:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     
     steps:
     - uses: actions/checkout@v4