diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index babf87e1..e17e39fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,8 +10,9 @@ permissions:
 
 # 竖线分隔在任何错误（含网络错误）时回退到下一个源；默认的逗号只在
 # 404/410 时回退，proxy.golang.org 瞬时故障会直接让整个 job 失败。
-# CI 保留自托管 Runner 的本机 Go 缓存；Release 使用 GitHub 托管的临时 Runner。
-# 两条流程都不下载/上传 setup-go 缓存，也无需 main push 预热。
+# CI 与 Release 的确定性验证保留自托管 Runner 的本机 Go 缓存；Release 的制品、
+# 发布和外部服务节点使用 GitHub 托管的临时 Runner。两条流程都不下载/上传
+# setup-go 缓存，也无需 main push 预热。
 env:
   GOPROXY: https://proxy.golang.org|direct
 
@@ -165,7 +166,7 @@ jobs:
 
   static-checks:
     needs: validate-tag
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, macOS, ARM64]
     timeout-minutes: 20
     steps:
       - name: Checkout tag commit
@@ -208,7 +209,7 @@ jobs:
     needs: validate-tag
     # 同一 commit 的 CI 已全绿时跳过；publication-preflight 接受 skipped 结果。
     if: ${{ needs.validate-tag.outputs.ci_verified != 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, macOS, ARM64]
     timeout-minutes: 20
     steps:
       - name: Checkout tag commit
@@ -228,7 +229,7 @@ jobs:
   race-cpa:
     needs: validate-tag
     if: ${{ needs.validate-tag.outputs.ci_verified != 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, ARM64]
     timeout-minutes: 10
     steps:
       - name: Checkout tag commit
@@ -250,7 +251,7 @@ jobs:
     name: Database contract (${{ matrix.driver }})
     needs: validate-tag
     if: ${{ needs.validate-tag.outputs.ci_verified != 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: [self-hosted, Linux, ARM64]
     timeout-minutes: 15
     strategy:
       fail-fast: false
diff --git a/internal/webui/workflow_self_hosted_test.go b/internal/webui/workflow_self_hosted_test.go
index 45d45656..aa955d1c 100644
--- a/internal/webui/workflow_self_hosted_test.go
+++ b/internal/webui/workflow_self_hosted_test.go
@@ -56,14 +56,24 @@ func TestReleaseIsolatesDockerCredentials(t *testing.T) {
 	}
 }
 
-func TestReleaseUsesGitHubHostedRunners(t *testing.T) {
+func TestReleaseUsesSelfHostedValidationAndHostedPublicationRunners(t *testing.T) {
 	content := readRepositoryFile(t, ".github/workflows/release.yml")
-	if strings.Contains(content, "self-hosted") {
-		t.Fatal("release workflow must not route release-specific jobs to self-hosted runners")
+	for job, runner := range map[string]string{
+		"static-checks":     "[self-hosted, macOS, ARM64]",
+		"race-tests":        "[self-hosted, macOS, ARM64]",
+		"race-cpa":          "[self-hosted, Linux, ARM64]",
+		"database-contract": "[self-hosted, Linux, ARM64]",
+	} {
+		block := workflowJobBlock(t, content, job)
+		if !strings.Contains(block, "runs-on: "+runner) {
+			t.Errorf("%s is not assigned to %s", job, runner)
+		}
+	}
+	if count := strings.Count(content, "self-hosted"); count != 4 {
+		t.Fatalf("release workflow contains %d self-hosted runner assignments, want 4", count)
 	}
 	for _, job := range []string{
-		"validate-tag", "verify-and-build-web", "static-checks", "race-tests", "race-cpa",
-		"database-contract", "package-metadata", "package-checksums", "docker-smoke",
+		"validate-tag", "verify-and-build-web", "package-metadata", "package-checksums", "docker-smoke",
 		"publication-preflight", "publish-images", "publish-github", "post-publish-image-smoke",
 		"post-publish-verify", "promote-image-channels", "deploy-render", "reconcile-publication",
 	} {