diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index a6fb111a..b80ab2a0 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -13,30 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: check
-        run: nix flake check --no-build
-
-  fmt:
-    name: formatting
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: nix fmt
-        run: nix fmt -- --check .
-      - name: cargo fmt
-        run: cargo fmt --all -- --check
-
-  test:
-    name: cargo test
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: test
-        run: cargo test --workspace
-
-  clippy:
-    name: cargo clippy
-    runs-on: [hive-ci]
-    steps:
-      - uses: actions/checkout@v3
-      - name: clippy
-        run: cargo clippy --workspace -- -D warnings
+        # Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
+        # cargo clippy, and module evaluation. No --no-build: the checks
+        # derivations are the canonical source of truth.
+        run: nix flake check
diff --git a/nix/modules/hive-ci.nix b/nix/modules/hive-ci.nix
index d62cef83..e1d788f0 100644
--- a/nix/modules/hive-ci.nix
+++ b/nix/modules/hive-ci.nix
@@ -115,11 +115,7 @@ in
 
     labels = lib.mkOption {
       type = lib.types.listOf lib.types.str;
-      default = [
-        "hive-ci:host"
-        "ubuntu-latest:host"
-        "ubuntu-22.04:host"
-      ];
+      default = [ "hive-ci:host" ];
       example = [
         "hive-ci:host"
         "nix:host"
@@ -128,10 +124,6 @@ in
         Runner labels in `<name>:<scheme>` format. The `host` scheme runs
         commands directly in the container (no docker/podman). Workflow
         files target this runner with `runs-on: [hive-ci]`.
-
-        The `ubuntu-latest` and `ubuntu-22.04` aliases let workflow files
-        that hardcode GitHub-style runner names work unchanged, as long as
-        those jobs only need git + nix + cargo and not Ubuntu APT packages.
       '';
     };
 
@@ -173,7 +165,7 @@ in
       config =
         { pkgs, lib, ... }:
         {
-          system.stateVersion = "25.11";
+          system.stateVersion = "26.05";
 
           # nspawn containers can't create user-namespaces, so nix
           # sandboxing always fails. Fall back to unsandboxed builds.