diff --git a/.github/workflows/distribute-pr.yml b/.github/workflows/distribute-pr.yml
index 682783d..0cbe27a 100644
--- a/.github/workflows/distribute-pr.yml
+++ b/.github/workflows/distribute-pr.yml
@@ -110,7 +110,8 @@ permissions:
 jobs:
   # ── Discover + validate every Config/products/<id>.json (cheap, fail-fast) ──
   # products.py validates identity + the mandatory inline changelog and fails
-  # loudly on a bad file — so this ubuntu job gates the expensive macOS verify.
+  # loudly on a bad file — so this cheap job gates the expensive verify below.
+  # (Ran on ubuntu until v0.4.7 moved every job to self-hosted macOS.)
   discover:
     runs-on: [self-hosted, macOS]
     timeout-minutes: 5
diff --git a/.github/workflows/memory-watch.yml b/.github/workflows/memory-watch.yml
index 7ea9812..a9224dd 100644
--- a/.github/workflows/memory-watch.yml
+++ b/.github/workflows/memory-watch.yml
@@ -132,7 +132,7 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  # Cheap gate on ubuntu (like the distribute-* prepare jobs). A per-commit cache
+  # Cheap gate (like the distribute-* prepare jobs). A per-commit cache
   # marker makes each commit on main get watched exactly once; `force` overrides.
   gate:
     runs-on: [self-hosted, macOS]
diff --git a/.github/workflows/selftest.yml b/.github/workflows/selftest.yml
index 1bf9b36..b90a14d 100644
--- a/.github/workflows/selftest.yml
+++ b/.github/workflows/selftest.yml
@@ -22,17 +22,29 @@ permissions:
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    # Self-hosted macOS, like every other job in this repo. This was the last
+    # `ubuntu-latest` left, and it was also the only workflow that stopped
+    # dispatching — GitHub-hosted runners are a separate capacity/billing path
+    # from ours, so a block there takes out this job while every self-hosted
+    # build keeps running. Nothing here needs Linux: actionlint ships a darwin
+    # build and the tests are offline python3 + git.
+    runs-on: [self-hosted, macOS]
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
 
       - name: Install actionlint
-        run: bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        # Into a temp dir, not the workspace: a self-hosted runner reuses its
+        # checkout, so dropping the binary next to the sources would leave an
+        # untracked ./actionlint behind between runs.
+        run: |
+          mkdir -p "$RUNNER_TEMP/actionlint"
+          cd "$RUNNER_TEMP/actionlint"
+          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
 
       - name: Lint workflows
         run: |
-          ./actionlint \
+          "$RUNNER_TEMP/actionlint/actionlint" \
             -ignore 'property "job_workflow_sha" is not defined' \
             -ignore 'shellcheck reported issue' \
             .github/workflows/*.yml