diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 30ce3439..6c64e073 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -11,10 +11,13 @@ on:
 jobs:
   # ─────────────────────────────────────────────
   # Lint, typecheck & unit tests
-  # Draait in een node:26 container op de Epic runner
+  # Draait op de host (self-hosted) waar Node 26 +
+  # pnpm 11 geïnstalleerd zijn en internet beschikbaar is.
+  # De job-container (docker mode) heeft GEEN outbound
+  # internet, dus we draaien alles direct op de host.
   # ─────────────────────────────────────────────
   check:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,10 +25,8 @@ jobs:
           repository: ${{ gitea.repository }}
           token: ${{ gitea.token }}
 
-      - name: Setup pnpm
-        run: |
-          corepack enable
-          corepack prepare pnpm@11.25.0 --activate
+      - name: Toolchain check
+        run: node scripts/check-node-toolchain.mjs
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --jobs 1
diff --git a/src/lib/ci-workflow-contract.test.ts b/src/lib/ci-workflow-contract.test.ts
index 7f14fb64..ecc86a61 100644
--- a/src/lib/ci-workflow-contract.test.ts
+++ b/src/lib/ci-workflow-contract.test.ts
@@ -28,17 +28,21 @@ describe("CI workflow", () => {
 		expect(workflow).toContain("pnpm test");
 	});
 
-	it("deploy uses self-hosted runner", () => {
-		expect(workflow).toContain("runs-on: self-hosted");
+	it("check job runs on self-hosted runner", () => {
+		const checkJob = workflow.slice(
+			workflow.indexOf("check:"),
+			workflow.indexOf("\n  deploy:"),
+		);
+		expect(checkJob).toContain("runs-on: self-hosted");
 	});
 
-	it("check uses ubuntu-latest runner", () => {
-		expect(workflow).toContain("runs-on: ubuntu-latest");
+	it("deploy job runs on self-hosted runner", () => {
+		const deployJob = workflow.slice(workflow.indexOf("\n  deploy:"));
+		expect(deployJob).toContain("runs-on: self-hosted");
 	});
 
-	it("installs pnpm via corepack", () => {
-		expect(workflow).toContain("corepack enable");
-		expect(workflow).toContain("corepack prepare pnpm@11.25.0");
+	it("check includes toolchain check", () => {
+		expect(workflow).toContain("scripts/check-node-toolchain.mjs");
 	});
 
 	it("does not use github context", () => {
diff --git a/src/lib/deploy-workflow-contract.test.ts b/src/lib/deploy-workflow-contract.test.ts
index b2a90c3a..f5b309b7 100644
--- a/src/lib/deploy-workflow-contract.test.ts
+++ b/src/lib/deploy-workflow-contract.test.ts
@@ -14,6 +14,10 @@ describe("deploy job", () => {
 		expect(deployJob).toContain("runs-on: self-hosted");
 	});
 
+	it("has checkout step", () => {
+		expect(deployJob).toContain("actions/checkout@v4");
+	});
+
 	it("builds Docker image with BuildKit", () => {
 		expect(deployJob).toContain("DOCKER_BUILDKIT=1");
 		expect(deployJob).toContain("docker build");