diff --git a/.github/workflows/fork-release.yml b/.github/workflows/fork-release.yml
index 0cf26a4c030a..a110d5165f96 100644
--- a/.github/workflows/fork-release.yml
+++ b/.github/workflows/fork-release.yml
@@ -4,6 +4,13 @@
 #
 # New file with a fork-unique name on purpose: upstream workflow files are
 # never edited here, so rebasing onto upstream stays conflict-free.
+#
+# Runs on the self-hosted GCP rust-heavy runner, not GitHub-hosted runners
+# (WI-1514): GitHub paused every workflow on this fork over Actions usage.
+# Only trusted events trigger it (pushes to fork/main, workflow_dispatch), so
+# no untrusted fork code reaches the self-hosted runner. The build runs there;
+# only the short publish job stays GitHub-hosted. x86_64 only: every consumer
+# (the Vogt engine on Node B) is x86_64.
 name: fork-release
 
 on:
@@ -21,15 +28,12 @@ env:
 jobs:
   build:
     name: ${{ matrix.target }}
-    runs-on: ${{ matrix.runner }}
+    runs-on: [self-hosted, rust-heavy]
     strategy:
       fail-fast: false
       matrix:
         include:
           - target: x86_64-unknown-linux-musl
-            runner: ubuntu-24.04
-          - target: aarch64-unknown-linux-musl
-            runner: ubuntu-24.04-arm
     # The workspace Cargo.toml is codex-rs/Cargo.toml; the repo root has none.
     defaults:
       run:
@@ -48,6 +52,22 @@ jobs:
           version: "0.14.0"
           use-cache: false
 
+      # rust-heavy jobs have no sudo; its image bakes the packages the upstream
+      # script apt-installs (spot-github-runners image/bake.sh). Shadow `sudo`
+      # so the script's apt-get lines are skipped and everything else runs.
+      - name: Skip apt on the self-hosted runner
+        if: runner.environment == 'self-hosted'
+        working-directory: ${{ github.workspace }}
+        run: |
+          set -euo pipefail
+          shim="${RUNNER_TEMP}/no-sudo"
+          mkdir -p "$shim"
+          printf '%s\n' '#!/usr/bin/env bash' \
+            'if [[ "${1:-}" == apt-get ]]; then echo "skip: sudo $*" >&2; exit 0; fi' \
+            'exec "$@"' > "$shim/sudo"
+          chmod +x "$shim/sudo"
+          echo "$shim" >> "$GITHUB_PATH"
+
       - name: Install musl build tools
         working-directory: ${{ github.workspace }}
         env:
@@ -147,6 +167,7 @@ jobs:
   release:
     name: publish
     needs: build
+    # Seconds of work, and it needs `gh`, which the rust-heavy image lacks.
     runs-on: ubuntu-24.04
     permissions:
       contents: write
@@ -181,4 +202,4 @@ jobs:
           gh release create "$tag" release/* \
             --target "$GITHUB_SHA" \
             --title "fork ${GITHUB_SHA:0:9}" \
-            --notes "Fork build of ${GITHUB_SHA}. Static musl binaries for x86_64 and aarch64; verify with SHA256SUMS."
+            --notes "Fork build of ${GITHUB_SHA}. Static musl binary for x86_64; verify with SHA256SUMS."
diff --git a/FORK.md b/FORK.md
index aed0bf0fda60..e701d2b4e075 100644
--- a/FORK.md
+++ b/FORK.md
@@ -66,3 +66,13 @@ OIDC, R2, winget, or `CODEX_OPENAI_API_KEY` are disabled on this fork with
 `gh workflow disable` — the workflow files themselves are not edited, so
 rebasing onto upstream stays conflict-free. The fork's own workflows are new
 files with fork-unique names (`fork-*.yml`).
+
+GitHub paused every workflow on the fork on 2026-10-15 over Actions usage.
+After it was re-enabled, the issue bots (`issue-deduplicator`, `issue-labeler`,
+`issue-translator`) were disabled too, leaving only `fork-ci` and
+`fork-release` active. `postmerge-ci` (push to `main`, no fork guard) is not
+registered yet and so cannot be disabled ahead of time: after the next mirror
+sync of `main`, cancel its run and `gh workflow disable postmerge-ci`.
+`fork-release` builds x86_64 only, on the self-hosted GCP `rust-heavy` runner,
+whose image bakes the musl build packages (WI-1514); only its short publish job
+runs GitHub-hosted.