diff --git a/.github/workflows/release-js.yml b/.github/workflows/release-js.yml
index f4b7bb1..e1ae6e5 100644
--- a/.github/workflows/release-js.yml
+++ b/.github/workflows/release-js.yml
@@ -155,7 +155,17 @@ jobs:
   publish:
     needs: [decide, package]
     if: needs.decide.outputs.publish == 'true'
-    runs-on: ubicloud-standard-2
+    # The one job in this repository that may not run on Ubicloud. npm signs a
+    # provenance statement on publish and the registry rejects the result from
+    # anything it reads as self-hosted, which is what an Ubicloud runner is:
+    #
+    #   npm error 422 Error verifying sigstore provenance bundle: Unsupported
+    #   GitHub Actions runner environment: "self-hosted". Only "github-hosted"
+    #   runners are supported when publishing with provenance.
+    #
+    # It fails at the registry rather than at the runner, so the release gets
+    # all the way to a packed tarball before it dies. Leave this alone.
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/release-oxc.yml b/.github/workflows/release-oxc.yml
index 8b085c1..6b5f82d 100644
--- a/.github/workflows/release-oxc.yml
+++ b/.github/workflows/release-oxc.yml
@@ -180,7 +180,10 @@ jobs:
   publish:
     needs: [decide, package]
     if: needs.decide.outputs.publish == 'true'
-    runs-on: ubicloud-standard-2
+    # GitHub-hosted for the same reason as `release-js`: npm rejects a
+    # provenance statement signed on a runner it reads as self-hosted, which
+    # an Ubicloud runner is. See that file for the registry's error.
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write