diff --git a/.github/actions/restore-pip-cache/action.yml b/.github/actions/restore-pip-cache/action.yml
index c67f5f9d4a..ed435059ab 100644
--- a/.github/actions/restore-pip-cache/action.yml
+++ b/.github/actions/restore-pip-cache/action.yml
@@ -5,7 +5,10 @@ runs:
   using: composite
   steps:
     - name: Set cache key
-      run: echo "CACHE_KEY=pip-numpy-$ImageOS" >> $GITHUB_ENV
+      # ImageOS is only set on GitHub-hosted runners; on a self-hosted one
+      # (cern1, alma10) key on the distribution instead, so it never restores
+      # a numpy built for the ubuntu image.
+      run: echo "CACHE_KEY=pip-numpy-${ImageOS:-$(. /etc/os-release && echo $ID$VERSION_ID)}" >> $GITHUB_ENV
       shell: bash
 
     # Generation-suffixed keys: see the comment in restore_heptools.
@@ -18,7 +21,14 @@ runs:
           ${{ env.CACHE_KEY }}
 
     - run: |
-        sudo apt install meson ninja-build
+        # meson+ninja from the system: apt on the ubuntu image; on a
+        # self-hosted runner (no sudo) they must be preinstalled
+        # (dnf install meson ninja-build on alma10), else pip installs them below.
+        if command -v apt-get > /dev/null; then
+          sudo apt install meson ninja-build
+        elif ! command -v meson > /dev/null || ! command -v ninja > /dev/null; then
+          echo "::warning::meson/ninja not installed on this runner, falling back to pip"
+        fi
         echo "PYTHONPATH=$PYTHONPATH:$HOME/.cache/pip-packages" >> $GITHUB_ENV
         echo "$HOME/.cache/pip-packages/bin" >> $GITHUB_PATH
         # Install meson+ninja if missing (numpy 2.x f2py requires meson as build backend).
diff --git a/.github/actions/restore_ufomodel/action.yml b/.github/actions/restore_ufomodel/action.yml
index fe1c3c237a..52f7aa984f 100644
--- a/.github/actions/restore_ufomodel/action.yml
+++ b/.github/actions/restore_ufomodel/action.yml
@@ -40,8 +40,14 @@ runs:
           ufomodel-
           ufomodel
 
+    # The cache can miss (a self-hosted runner without zstd cannot read the
+    # .tzst entry written on ubuntu); the models extracted above are then all
+    # there is, so an empty cache must not fail the step.
     - run: |
+        mkdir -p $HOME/.cache/UFOMODEL
         echo "PYTHONPATH=$PYTHONPATH:$HOME/.cache/UFOMODEL" >> $GITHUB_ENV
-        cp -r $HOME/.cache/UFOMODEL/* $GITHUB_WORKSPACE/models
+        if [ -n "$(ls -A $HOME/.cache/UFOMODEL)" ]; then
+          cp -r $HOME/.cache/UFOMODEL/* $GITHUB_WORKSPACE/models
+        fi
         ls $GITHUB_WORKSPACE/models
       shell: bash
diff --git a/.github/workflows/aloha.yml b/.github/workflows/aloha.yml
index cc6e713a5b..ba87c06f55 100644
--- a/.github/workflows/aloha.yml
+++ b/.github/workflows/aloha.yml
@@ -40,7 +40,9 @@ jobs:
   # This workflow contains a single job called "build"
   test_aloha:
     # The type of runner that the job will run on
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
 
     # Steps represent a sequence of tasks that will be executed as part of the job
@@ -59,7 +61,9 @@ jobs:
   test_excluded:
     # excluded due to side effect
     # The type of runner that the job will run on
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
 
     # Steps represent a sequence of tasks that will be executed as part of the job
diff --git a/.github/workflows/unittest.yml b/.github/workflows/unittest.yml
index 309b7232a1..013bfea7e5 100644
--- a/.github/workflows/unittest.yml
+++ b/.github/workflows/unittest.yml
@@ -47,7 +47,9 @@ jobs:
     #   unittest_26 unittest_28 unittest_31 unittest_32 unittest_33
     #   unittest_customize_model
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -212,7 +214,9 @@ jobs:
     #   unittest_6 unittest_8 unittest_9 unittest_13 unittest_14 unittest_15
     #   unittest_21 unittest_30 unittest_config_location
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -319,7 +323,9 @@ jobs:
     # former jobs, run one after the other: unittest_10 unittest_density_29
     #   unittest_madspin_sequential
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -343,7 +349,8 @@ jobs:
         if: ${{ !cancelled() }}
         run: |
             cd $GITHUB_WORKSPACE
-            sudo pip install scipy
+            # no sudo/apt on the self-hosted runner: user install there
+            if command -v apt-get > /dev/null; then sudo pip install scipy; else python3 -m pip install --user scipy; fi
             ./tests/test_manager.py test_DensityMatrixObservables test_DensityMatrixObservables22 test_DensityMatrixObservables23 test_DensityMatrixObservables33 test_utilities -t0
 
       # ---- unittest_madspin_sequential ----
@@ -354,7 +361,8 @@ jobs:
         if: ${{ !cancelled() }}
         run: |
             cd $GITHUB_WORKSPACE
-            sudo pip install numpy
+            # no sudo/apt on the self-hosted runner: user install there
+            if command -v apt-get > /dev/null; then sudo pip install numpy; else python3 -m pip install --user numpy; fi
             ./tests/test_manager.py test_madspin test_lhe_parser -t0
 
 
@@ -362,7 +370,9 @@ jobs:
     # former jobs, run one after the other: unittest_18_2 unittest_24
     #   unittest_uncovered
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -395,7 +405,9 @@ jobs:
     # former jobs, run one after the other: unittest_18_3 unittest_19
     #   unittest_27
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -425,7 +437,9 @@ jobs:
   unittest_bundle_6:
     # former jobs, run one after the other: unittest_22 unittest_29
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     steps:
       - uses: actions/checkout@v5
@@ -461,7 +475,9 @@ jobs:
 
   unittest_new_coverage:
     # New unit tests added in 3.7.1: q_polynomial and hepmc_parser
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
     permissions:
       contents: read
@@ -477,7 +493,9 @@ jobs:
 
   unittest_write_model:
     # runs alone: excluded from the shared unittest jobs due to side effects
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork == true
 
     steps: