diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0aa540ed8bee..4b3b8f36d3c3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
   # ─────────────────────────────────────────────────────────────────────
   detect:
     name: Detect affected areas
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     outputs:
       python: ${{ steps.classify.outputs.python }}
@@ -280,7 +280,7 @@ jobs:
       # we don't require docker to pass rn because it's so slow lol
       # - docker
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     outputs:
       needs-json: ${{ steps.evaluate.outputs.needs-json }}
@@ -322,7 +322,7 @@ jobs:
     name: CI timing report
     needs: [all-checks-pass, docker]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     steps:
       - name: Checkout code
diff --git a/.github/workflows/contributor-check.yml b/.github/workflows/contributor-check.yml
index 014e1e2ff93d..ae83d73b4bbe 100644
--- a/.github/workflows/contributor-check.yml
+++ b/.github/workflows/contributor-check.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check-attribution:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     outputs:
       review_status: ${{ steps.check-emails.outputs.review_status }}
diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml
index fd09205a055c..81ec6571a77a 100644
--- a/.github/workflows/deploy-site.yml
+++ b/.github/workflows/deploy-site.yml
@@ -40,7 +40,7 @@ jobs:
     # a skills-index PR that doesn't touch website/** paths and so
     # doesn't auto-deploy via the deploy-docs path.
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 30
     steps:
       - name: Trigger Vercel Deploy
@@ -48,7 +48,7 @@ jobs:
 
   deploy-docs:
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 30
     environment:
       name: github-pages
diff --git a/.github/workflows/docker-lint.yml b/.github/workflows/docker-lint.yml
index 89b80fa10e09..fd4e4cae0d5e 100644
--- a/.github/workflows/docker-lint.yml
+++ b/.github/workflows/docker-lint.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   hadolint:
     name: Lint Dockerfile (hadolint)
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -38,7 +38,7 @@ jobs:
 
   shellcheck:
     name: Lint docker/ shell scripts (shellcheck)
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     steps:
       - name: Checkout code
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index f500aca99537..3f8a91268054 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -157,7 +157,7 @@ jobs:
   # ---------------------------------------------------------------------------
   merge:
     if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     needs: [build]
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/docs-site-checks.yml b/.github/workflows/docs-site-checks.yml
index 41acf1790f48..027a874cd09e 100644
--- a/.github/workflows/docs-site-checks.yml
+++ b/.github/workflows/docs-site-checks.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   docs-site-checks:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/history-check.yml b/.github/workflows/history-check.yml
index 668f0f795dd9..cf513012abea 100644
--- a/.github/workflows/history-check.yml
+++ b/.github/workflows/history-check.yml
@@ -25,7 +25,7 @@ permissions:
 
 jobs:
   check-common-ancestor:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     outputs:
       review_status: ${{ steps.merge-base-check.outputs.review_status }}
diff --git a/.github/workflows/js-autofix.yml b/.github/workflows/js-autofix.yml
index 8fb0460bc056..84f39c246378 100644
--- a/.github/workflows/js-autofix.yml
+++ b/.github/workflows/js-autofix.yml
@@ -57,7 +57,7 @@ concurrency:
 jobs:
   generate-patch:
     name: Generate eslint --fix patch
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     outputs:
       has-fixes: ${{ steps.produce-patch.outputs.has-fixes }}
@@ -120,7 +120,7 @@ jobs:
     # Skip entirely when generate-patch found no fixes — saves a runner,
     # avoids a redundant checkout/download, and keeps the job graph honest.
     if: needs.generate-patch.outputs.has-fixes == 'true'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     permissions:
       contents: write # needed to push to bot/js-autofix
diff --git a/.github/workflows/js-tests.yml b/.github/workflows/js-tests.yml
index 4e4622f72d04..24c5f219d53e 100644
--- a/.github/workflows/js-tests.yml
+++ b/.github/workflows/js-tests.yml
@@ -7,7 +7,7 @@ on:
 jobs:
   workspaces:
     name: List npm workspaces
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 20
     outputs:
       packages: ${{ steps.set-matrix.outputs.packages }}
@@ -32,7 +32,7 @@ jobs:
   check:
     name: Typecheck & Test
     needs: workspaces
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 20
     strategy:
       matrix:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 670b6f2a44a2..d2f12edb31b1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -30,7 +30,7 @@ jobs:
   lint-diff:
     name: ruff + ty diff
     if: inputs.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     steps:
       - name: Checkout code
@@ -121,7 +121,7 @@ jobs:
     # ``lint-diff`` job above runs independently so reviewers still get
     # the diff comment even when enforcement fails.
     name: ruff enforcement (blocking)
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -147,7 +147,7 @@ jobs:
     # shebang scripts via subprocess, bare open() without encoding=, etc.
     # See scripts/check-windows-footguns.py for the full rule list.
     name: Windows footguns (blocking)
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     steps:
       - name: Checkout code
diff --git a/.github/workflows/lockfile-diff.yml b/.github/workflows/lockfile-diff.yml
index 9d8d59f6da7e..35b567623511 100644
--- a/.github/workflows/lockfile-diff.yml
+++ b/.github/workflows/lockfile-diff.yml
@@ -34,7 +34,7 @@ concurrency:
 jobs:
   diff:
     name: package-lock.json semantic diff
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     outputs:
       changed: ${{ steps.diff.outputs.changed }}
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 455ede33dd56..f90759ea875b 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -55,7 +55,7 @@ jobs:
 
   emit-status:
     name: Emit review status
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     needs: scan
     if: always()
     outputs:
diff --git a/.github/workflows/skills-index-freshness.yml b/.github/workflows/skills-index-freshness.yml
index 4931ccaa0101..eb06fb812695 100644
--- a/.github/workflows/skills-index-freshness.yml
+++ b/.github/workflows/skills-index-freshness.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   check-freshness:
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     steps:
       - name: Probe live index
diff --git a/.github/workflows/skills-index.yml b/.github/workflows/skills-index.yml
index ae05c9e70466..67c7249ee301 100644
--- a/.github/workflows/skills-index.yml
+++ b/.github/workflows/skills-index.yml
@@ -19,7 +19,7 @@ jobs:
   build-index:
     # Only run on the upstream repository, not on forks
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -58,7 +58,7 @@ jobs:
   trigger-deploy:
     needs: build-index
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     steps:
       - name: Get GitHub App token
diff --git a/.github/workflows/supply-chain-audit.yml b/.github/workflows/supply-chain-audit.yml
index 7ee20e029a7c..0c39e9794439 100644
--- a/.github/workflows/supply-chain-audit.yml
+++ b/.github/workflows/supply-chain-audit.yml
@@ -54,7 +54,7 @@ jobs:
   scan:
     name: Scan PR for critical supply chain risks
     if: inputs.scan
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     outputs:
       review_status: ${{ steps.emit-status.outputs.review_status }}
@@ -187,7 +187,7 @@ jobs:
   dep-bounds:
     name: Check PyPI dependency upper bounds
     if: inputs.deps
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     outputs:
       review_status: ${{ steps.emit-status.outputs.review_status }}
@@ -266,7 +266,7 @@ jobs:
     name: Aggregate review statuses
     needs: [scan, dep-bounds]
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     outputs:
       review_status: ${{ steps.merge.outputs.review_status }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index cdae2e037a59..13629966ed97 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -19,7 +19,7 @@ concurrency:
 jobs:
   generate:
     name: "Generate slices"
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     outputs:
       matrix: ${{ steps.matrix.outputs.matrix }}
@@ -48,7 +48,7 @@ jobs:
   test:
     name: Run tests slice ${{ matrix.slice.index }}/${{ inputs.slice_count }}
     needs: generate
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -135,7 +135,7 @@ jobs:
   save-durations:
     needs: test
     if: needs.test.result == 'success' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 10
     steps:
       - name: Download all slice durations
@@ -165,7 +165,7 @@ jobs:
           key: test-durations-${{ github.run_id }}
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 15
     steps:
       - name: Checkout code
diff --git a/.github/workflows/uv-lockfile-check.yml b/.github/workflows/uv-lockfile-check.yml
index aff4f0eb8cbd..5943a413ed33 100644
--- a/.github/workflows/uv-lockfile-check.yml
+++ b/.github/workflows/uv-lockfile-check.yml
@@ -60,7 +60,7 @@ concurrency:
 jobs:
   check:
     name: uv lock --check
-    runs-on: ubuntu-latest
+    runs-on: arc-runner-set
     timeout-minutes: 5
     outputs:
       review_status: ${{ steps.verify.outputs.review_status }}