diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index 0a1ffa3..c2d87ea 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -1,5 +1,5 @@
 name: Dependabot auto-approve
-on: pull_request_target
+on: pull_request
 
 permissions:
   pull-requests: write
@@ -7,7 +7,7 @@ permissions:
 
 jobs:
   dependabot:
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
diff --git a/.github/workflows/pipeline.yaml b/.github/workflows/pipeline.yaml
index 4b5bc0f..cf9ef60 100644
--- a/.github/workflows/pipeline.yaml
+++ b/.github/workflows/pipeline.yaml
@@ -9,7 +9,7 @@ on:
       - v*
     paths-ignore:
       - '**.md'
-  pull_request_target:
+  pull_request:
     branches:
       - main
     paths-ignore:
@@ -23,7 +23,7 @@ env:
 
 jobs:
   go-lint:
-    runs-on: [ self-hosted, Linux, X64 ]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -46,7 +46,7 @@ jobs:
           args: -e S1008 --timeout 15m
 
   go-test:
-    runs-on: [ self-hosted, Linux, X64 ]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -67,7 +67,7 @@ jobs:
         run: make test
 
   kustomize-test:
-    runs-on: [ self-hosted, Linux, X64 ]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -84,7 +84,7 @@ jobs:
 
   docker-build:
     needs: [ kustomize-test, go-lint, go-test ]
-    runs-on: [ self-hosted, Linux, X64 ]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index f9ef627..60d1bc4 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -4,11 +4,11 @@ on:
   push:
     branches:
       - main
-  pull_request_target:
+  pull_request:
 
 jobs:
   update_release_draft:
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     steps:
       - uses: release-drafter/release-drafter@v6
         with:
diff --git a/.github/workflows/size-labels.yaml b/.github/workflows/size-labels.yaml
index 487cfeb..afe57e7 100644
--- a/.github/workflows/size-labels.yaml
+++ b/.github/workflows/size-labels.yaml
@@ -4,7 +4,7 @@ on: [workflow_dispatch, pull_request]
 
 jobs:
   size-label:
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write