diff --git a/.gitea/workflows/browser-canary.yml b/.gitea/workflows/browser-canary.yml
index e8802b4..36a33bc 100644
--- a/.gitea/workflows/browser-canary.yml
+++ b/.gitea/workflows/browser-canary.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   chromium:
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 1ae1495..49a2012 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
   acceptance:
     # Never execute code from an untrusted public fork on the private runner.
     if: ${{ gitea.event.pull_request.head.repo.full_name == gitea.repository }}
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
diff --git a/.gitea/workflows/live-canary.yml b/.gitea/workflows/live-canary.yml
index fc56c6e..792e94b 100644
--- a/.gitea/workflows/live-canary.yml
+++ b/.gitea/workflows/live-canary.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   public-probe:
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 3
     steps:
       - name: Verify HTTPS readiness and certificate horizon
diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml
index 3ee15ba..7747c57 100644
--- a/.gitea/workflows/managed-validation.yml
+++ b/.gitea/workflows/managed-validation.yml
@@ -1,6 +1,8 @@
 name: Managed validation
 
 on:
+  push:
+    branches: [master]
   workflow_dispatch:
     inputs:
       profile:
@@ -20,7 +22,7 @@ concurrency:
 jobs:
   full:
     name: full
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 772f794..1a770d5 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   release-evidence:
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Build commit-labelled release images
diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml
index 0ce39f2..5eafc32 100644
--- a/.gitea/workflows/security.yml
+++ b/.gitea/workflows/security.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   images:
-    runs-on: ubuntu-latest
+    runs-on: linux-validation
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
diff --git a/.gitea/workflows/unraid-deploy.yml b/.gitea/workflows/unraid-deploy.yml
deleted file mode 100644
index ab7e01c..0000000
--- a/.gitea/workflows/unraid-deploy.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: Unraid autoredeploy
-
-on:
-  push:
-    branches: [master]
-    paths-ignore:
-      - ".gitea/**"
-      - "docs/**"
-      - "**/*.md"
-  workflow_dispatch:
-
-concurrency:
-  group: unraid-production-mobilityops
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    name: Deploy mobilityops
-    runs-on: unraid-deploy
-    timeout-minutes: 180
-    steps:
-      - name: Deploy exact Gitea revision
-        run: |
-          set -euo pipefail
-          docker exec gitea-deploy-control \
-            /opt/gitea-deploy/deploy.py deploy \
-            "$GITHUB_REPOSITORY" "$GITHUB_SHA"
-