diff --git a/.github/workflows/IOtest.yml b/.github/workflows/IOtest.yml
index 2bd41a6a93..5deeaebc14 100644
--- a/.github/workflows/IOtest.yml
+++ b/.github/workflows/IOtest.yml
@@ -45,7 +45,9 @@ jobs:
     #   IOtest_fks IOtest_fd_gauge IOtest_export
     #   IOtest_unit_proc IOtest_ewsudakov
     # Each keeps its own steps, run even when an earlier one failed.
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     steps:
       - uses: actions/checkout@v5
 
@@ -101,7 +103,9 @@ jobs:
 
   # Loop squared-order IOTest – needs UFO model cache (from unittest_29)
   IOtest_loop_sqso:
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/restore_ufomodel
@@ -176,7 +180,9 @@ jobs:
 
   # Gnuplot histogram output IOTest (from acceptancetest_100)
   IOtest_gnuplot:
-    runs-on: ubuntu-24.04
+    # Runs on the self-hosted alma10 runners (cern1, ...) to spare the hosted queue;
+    # fork PRs stay on ubuntu-24.04 so outside code never runs on our machines.
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || fromJSON('["self-hosted", "alma10"]') }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/checkout_mg5