diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a39168c..5fcdc1a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,7 +3,7 @@ on: [push, pull_request]
 jobs:
   lint:
     # Hard rule (docs/MAINTAINABILITY.md): any finding fails the build.
-    runs-on: ubuntu-latest
+    runs-on: debian-13
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -13,10 +13,7 @@ jobs:
       - run: cd web && npm ci
       - run: make lint
   test:
-    strategy:
-      matrix:
-        arch: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.arch }}
+    runs-on: debian-13
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
@@ -30,14 +27,14 @@ jobs:
       - run: make test-v6only
       - run: make build && file nmon | grep -q 'statically linked'
   postgres:
-    runs-on: ubuntu-latest
+    runs-on: debian-13
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with: { go-version: stable }
       - run: make test-pg
   openapi:
-    runs-on: ubuntu-latest
+    runs-on: debian-13
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }