diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4043ac..e2547b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,10 +11,18 @@ permissions:
 
 jobs:
   check:
-    # The runner lives on VD-FW next to production keys: never run fork code there.
+    # Keep fork approval/guards; tests also run under an unprivileged account.
     if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: [self-hosted, Linux, X64, tuejon-ci]
+    runs-on: [self-hosted, Linux, X64, tuejon-ci, ci-public]
     steps:
+      - name: Verify runner isolation
+        run: |
+          test "$(id -un)" = ci-public
+          test -z "$(id -nG | tr ' ' '\n' | grep -E '^(sudo|docker)$' || true)"
+          test ! -r /home/vd/.ssh/id_ed25519
+          test ! -r /run/docker.sock
+          ! sudo -n true 2>/dev/null
+          python3 -c 'import os; assert not os.access("/home/vd", os.R_OK | os.X_OK)'
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: