diff --git a/.github/workflows/go-cli.yml b/.github/workflows/go-cli.yml
index 0ce934e..1212fb6 100644
--- a/.github/workflows/go-cli.yml
+++ b/.github/workflows/go-cli.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   lint-and-test:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
       contents: read
     steps:
@@ -47,7 +47,7 @@ jobs:
           if-no-files-found: error
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
@@ -75,7 +75,7 @@ jobs:
   # Hermetic parity gate: read-configuration golden comparison + the contract
   # lane of the parity matrix (flag validation / output contract, no Docker).
   parity:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
@@ -125,7 +125,7 @@ jobs:
   # on quiet days. Runs on schedule/dispatch so the daily lanes' `needs:` is satisfied.
   daily-changes:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       run: ${{ steps.check.outputs.run }}
     steps:
@@ -161,7 +161,7 @@ jobs:
       && needs.lint-and-test.result == 'success'
       && (github.event_name == 'push' || github.event_name == 'pull_request'
           || needs.daily-changes.outputs.run == 'true')
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     strategy:
       fail-fast: false
       matrix:
@@ -240,7 +240,7 @@ jobs:
   parity-publish-full:
     needs: [lint-and-test, daily-changes]
     if: needs.daily-changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v7
         with:
@@ -268,7 +268,7 @@ jobs:
   # publish) into the one true cross-lane number.
   parity-runtime-gate:
     if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [lint-and-test, e2e, parity, parity-runtime, parity-publish-full]
     steps:
       - uses: actions/checkout@v7
@@ -313,7 +313,7 @@ jobs:
           done
 
   cross-compile:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: lint-and-test
     steps:
       - uses: actions/checkout@v7
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 53d0b82..4da837b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
   # exists; on dispatch we compute the version and validate the tag is free, but
   # DO NOT tag yet (the `tag` job below tags only after the gates pass).
   prepare:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     outputs:
       version: ${{ steps.resolve.outputs.version }}
       tag: ${{ steps.resolve.outputs.tag }}
@@ -76,7 +76,7 @@ jobs:
   # Hermetic gates — the same task targets CI runs on every push/PR.
   # The release is blocked unless these pass.
   gate:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: prepare
     steps:
       - uses: actions/checkout@v7
@@ -106,7 +106,7 @@ jobs:
 
   # Runtime lane (real Docker containers). ubuntu-latest ships Docker.
   gate-runtime:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: prepare
     steps:
       - uses: actions/checkout@v7
@@ -144,7 +144,7 @@ jobs:
   # skipped (the tag already exists). The GITHUB_TOKEN push does not re-trigger the
   # workflow, so there is no second run.
   tag:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, gate, gate-runtime]
     if: github.event_name == 'workflow_dispatch'
     steps:
@@ -160,7 +160,7 @@ jobs:
           git push origin "${{ needs.prepare.outputs.tag }}"
 
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, gate, gate-runtime, tag]
     # `tag` is skipped on the push path, so gate on explicit success/skip rather
     # than the default all-succeeded semantics.
@@ -193,7 +193,8 @@ jobs:
       # Multi-arch image build (arm64 emulated) + buildx driver for the
       # dockers:/docker_manifests: blocks in .goreleaser.yml.
       - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@v1
 
       # GHCR login. Only reached on the tag path (this workflow is push.tags),
       # never on PRs, so images are pushed exclusively from an approved tag run.
@@ -270,7 +271,7 @@ jobs:
 
   # Non-gating: perf/distribution metrics recorded per release, never blocks.
   metrics:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     needs: [prepare, goreleaser]
     continue-on-error: true
     steps: