diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 54764db0..84c01cd7 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -11,7 +11,7 @@ jobs:
   check:
     name: nix flake check
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     # 30 min is well above a cold-cache rebuild (~15 min observed) and well
     # under the runner's 3h cap
     timeout-minutes: 30
@@ -23,7 +23,7 @@ jobs:
   tracker-tags:
     name: tracker-tag lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -33,7 +33,7 @@ jobs:
   comment-blocks:
     name: comment-block lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -43,7 +43,7 @@ jobs:
   doc-refs:
     name: doc-pointer lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -53,7 +53,7 @@ jobs:
   attribution-trailers:
     name: attribution-trailer lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -65,7 +65,7 @@ jobs:
   dashboard-descriptions:
     name: dashboard-description lint
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -77,7 +77,7 @@ jobs:
   shellcheck:
     name: shellcheck
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v3
@@ -94,7 +94,7 @@ jobs:
   prose-lint:
     name: prose lint (vale)
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
@@ -107,7 +107,7 @@ jobs:
   prose-lint-errors:
     name: prose lint (vale, errors)
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
diff --git a/.forgejo/workflows/coverage.yml b/.forgejo/workflows/coverage.yml
index aec15769..2d38e361 100644
--- a/.forgejo/workflows/coverage.yml
+++ b/.forgejo/workflows/coverage.yml
@@ -18,7 +18,7 @@ jobs:
   coverage:
     name: cargo llvm-cov
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     # Above the 30 min `nix flake check` allows, because instrumented
     # builds are slower than the ordinary ones and this starts from a
     # cache that the normal jobs never populate.
diff --git a/.forgejo/workflows/flake-update.yml b/.forgejo/workflows/flake-update.yml
index 0bbd3ed9..6d366f4a 100644
--- a/.forgejo/workflows/flake-update.yml
+++ b/.forgejo/workflows/flake-update.yml
@@ -23,7 +23,7 @@ jobs:
   update:
     name: nix flake update
     if: vars.PUBLIC_FORGE != 'true'
-    runs-on: [hive-ci]
+    runs-on: ${{ vars.PUBLIC_FORGE == 'true' && 'nixos' || 'hive-ci' }}
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3