diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..3453c7e
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - tart
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index fd08438..34225c3 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -2,6 +2,7 @@ name: CI
 
 on:
   push:
+    branches: [main]
     paths-ignore:
       - '**.md'
   pull_request:
@@ -14,7 +15,8 @@ concurrency:
 
 jobs:
   checks:
-    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - uses: actions/checkout@v4
 
@@ -37,18 +39,19 @@ jobs:
       - run: npm test
 
   runSdkManager:
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.os }} - ${{ matrix.cmdline-tools-version }}
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ matrix.platform.runner }}
+    name: ${{ matrix.platform.name }} - ${{ matrix.cmdline-tools-version }}
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-24.04
-          - ubuntu-22.04
-          - macos-15
-          - macos-14
-          - windows-2025
-          - windows-2022
+        platform:
+          - name: macos-arm64
+            runner: [self-hosted, macOS, ARM64, tart]
+          - name: linux-x64
+            runner: [self-hosted, linux, x64]
+          - name: windows-x64
+            runner: [self-hosted, windows, x64]
         cmdline-tools-version:
           - 14742923
           - 13114758
@@ -82,13 +85,15 @@ jobs:
         with:
           cmdline-tools-version: ${{ matrix.cmdline-tools-version }}
           log-accepted-android-sdk-licenses: 'false'
+          # The obsolete tools package is absent on clean self-hosted images.
+          packages: platform-tools
 
       - run: sdkmanager --list
 
   CI:
-    if: always()
+    if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     needs: [checks, runSdkManager]
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - run: |
           if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c3b9f22..4032d6d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -22,8 +22,9 @@ on:
 
 jobs:
   analyze:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Analyze
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index be95f5f..b46dcd4 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   dependabot:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'premex-pot[bot]' }}
     steps:
       # Generate an elevated token via the Premex Pot GitHub App.
diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml
index dc430c2..9a65d74 100644
--- a/.github/workflows/run.yml
+++ b/.github/workflows/run.yml
@@ -8,13 +8,13 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
+        runner:
+          - [self-hosted, linux, x64]
+          - [self-hosted, windows, x64]
+          - [self-hosted, macOS, ARM64, tart]
 
     # Disabled, because daveol/SampleApplication is missing
     if: ${{ false }}
diff --git a/.github/workflows/update-sdk-versions.yml b/.github/workflows/update-sdk-versions.yml
index 00ef7ff..c0a15f9 100644
--- a/.github/workflows/update-sdk-versions.yml
+++ b/.github/workflows/update-sdk-versions.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, macOS, ARM64, tart]
     steps:
       - uses: actions/create-github-app-token@v2
         id: app-token