diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 08ceec9..5a5dafa 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,27 +7,30 @@ on:
   pull_request:
 
 env:
-  GO_VERSION: 1.17
+  GO_VERSION: "1.20"
   GOLANGCI_LINT_VERSION: v1.43.0
 
 jobs:
   main:
     name: Main Process
-    runs-on: ubuntu-latest
+    # Our runners only (the org's GitHub Actions budget is capped). A fork's
+    # PR never runs on our machines.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [self-hosted, Linux, ARM64, neboloop]
 
     steps:
       - name: Set up Go ${{ env.GO_VERSION }}
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Cache Go modules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
diff --git a/.github/workflows/no-hosted-runners.yml b/.github/workflows/no-hosted-runners.yml
new file mode 100644
index 0000000..576871b
--- /dev/null
+++ b/.github/workflows/no-hosted-runners.yml
@@ -0,0 +1,36 @@
+name: No GitHub-hosted runners
+
+# Every NeboLoop workflow runs on our own machines (the stadium Mac mini's
+# runners, the house Windows box, or a per-run DigitalOcean droplet): the
+# org's GitHub Actions budget is capped. Fails a PR whose workflows name a
+# GitHub-hosted label (ubuntu-*, macos-*, windows-*). The same check as
+# NeboLoop/stadium-runners' reusable no-hosted-runners.yml, inlined because a
+# public repo cannot call a workflow in a private one. Only .github/ is checked
+# out and nothing from the PR is executed.
+on:
+  pull_request:
+    paths: [".github/**"]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: [self-hosted, Linux, ARM64, neboloop-orch]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - name: Workflows use our runners only
+        run: |
+          shopt -s nullglob
+          bad=$(for f in .github/workflows/*.yml .github/workflows/*.yaml; do
+            sed 's/#.*//' "$f" | grep -nE '\b(ubuntu|macos|windows)-(latest|slim|[0-9])' | sed "s|^|$f:|"
+          done)
+          if [ -n "$bad" ]; then
+            echo "::error::GitHub-hosted runners are not used in NeboLoop. Use [self-hosted, Linux, ARM64, neboloop] (light), neboloop-orch (orchestration), stadium-mac, stadium-win, or a per-run droplet."
+            echo "$bad"
+            exit 1
+          fi
+          echo "no GitHub-hosted runner labels"