diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 8d1eb1b..9e0eefd 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -228,4 +228,16 @@ jobs:
           } finally {
             fs.rmSync(fixtureRoot, { recursive: true, force: true });
           }
+          for (const reusablePath of [
+            ".github/workflows/plugin-ci.yml",
+            ".github/workflows/validate-plugin-manifest.yml",
+          ]) {
+            const reusable = fs.readFileSync(reusablePath, "utf8");
+            if (!/if:\s*>-\s*\n\s+github\.event_name != 'pull_request' \|\|\s*\n\s+github\.event\.pull_request\.head\.repo\.full_name == github\.repository/.test(reusable)) {
+              throw new Error("self-hosted reusable CI must skip fork pull requests: " + reusablePath);
+            }
+            if (!/runs-on:\s*\n\s+group:\s*lvis-oracle-ci\s*\n\s+labels:\s*\[self-hosted, linux, arm64, oracle\]/.test(reusable)) {
+              throw new Error("self-hosted reusable CI must use only lvis-oracle-ci: " + reusablePath);
+            }
+          }
           NODE
diff --git a/.github/workflows/plugin-ci.yml b/.github/workflows/plugin-ci.yml
index aece4bf..71eac30 100644
--- a/.github/workflows/plugin-ci.yml
+++ b/.github/workflows/plugin-ci.yml
@@ -13,7 +13,12 @@ concurrency:
   cancel-in-progress: true
 jobs:
   build-test:
-    runs-on: [self-hosted, linux, arm64, oracle]
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on:
+      group: lvis-oracle-ci
+      labels: [self-hosted, linux, arm64, oracle]
     env:
       BUN_INSTALL: /tmp/lvis-bun-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
     permissions:
diff --git a/.github/workflows/validate-plugin-manifest.yml b/.github/workflows/validate-plugin-manifest.yml
index 9af0ab4..94c45c2 100644
--- a/.github/workflows/validate-plugin-manifest.yml
+++ b/.github/workflows/validate-plugin-manifest.yml
@@ -13,7 +13,12 @@ on:
 
 jobs:
   validate:
-    runs-on: [self-hosted, linux, arm64, oracle]
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on:
+      group: lvis-oracle-ci
+      labels: [self-hosted, linux, arm64, oracle]
     permissions:
       contents: read
     steps: