diff --git a/.forgejo/workflows/work-records.yaml b/.forgejo/workflows/work-records.yaml
index 9eae785..4f663d7 100644
--- a/.forgejo/workflows/work-records.yaml
+++ b/.forgejo/workflows/work-records.yaml
@@ -18,11 +18,15 @@ on:
 
 jobs:
   validate:
-    runs-on: self-hosted
+    # Runner substrate: ubuntu-latest maps to docker://node:20-bookworm (no
+    # python) — install python3 + deps via apt (same pattern as kaizen ci.yml).
+    runs-on: ubuntu-latest
     steps:
       - name: Fetch repo + canon, validate work records
         run: |
           set -eu
+          apt-get update -qq >/dev/null
+          apt-get install -y -qq python3 python3-yaml python3-jsonschema wget >/dev/null
           WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
           REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
           BASE="https://forgejo.coulomb.social"
@@ -34,6 +38,5 @@ jobs:
           wget -qO "$WORK/canon.tar.gz" \
             "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
           tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
-          python3 -m pip install --user --quiet pyyaml jsonschema
           python3 "$WORK/canon/tools/validate_work_records.py" \
             --repo "$WORK/repo" --canon "$WORK/canon"