diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml
index 0d1545a..af073d9 100644
--- a/.github/workflows/callable-dependency-review.yaml
+++ b/.github/workflows/callable-dependency-review.yaml
@@ -14,7 +14,8 @@ permissions:
   contents: read
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/callable-labeler.yaml b/.github/workflows/callable-labeler.yaml
index e0d0f21..fd65942 100644
--- a/.github/workflows/callable-labeler.yaml
+++ b/.github/workflows/callable-labeler.yaml
@@ -35,7 +35,8 @@ concurrency:
 
 jobs:
   label:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     steps:
       - name: Write central label rules
         run: |
diff --git a/.github/workflows/ci-autofix.yaml b/.github/workflows/ci-autofix.yaml
index 074eada..78bf8d4 100644
--- a/.github/workflows/ci-autofix.yaml
+++ b/.github/workflows/ci-autofix.yaml
@@ -88,7 +88,8 @@ jobs:
   autofix:
     name: autofix
     if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork }}
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-autofix-${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/ci-docker.yaml b/.github/workflows/ci-docker.yaml
index 7cb3bc4..2660305 100644
--- a/.github/workflows/ci-docker.yaml
+++ b/.github/workflows/ci-docker.yaml
@@ -48,7 +48,8 @@ permissions:
 jobs:
   docker:
     name: docker
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 30
     concurrency:
       group: ci-docker-${{ github.workflow }}-${{ github.ref }}-${{ inputs.context }}-${{ inputs.dockerfile }}-docker
diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml
index cd9fb0d..4cc57da 100644
--- a/.github/workflows/ci-dotnet.yaml
+++ b/.github/workflows/ci-dotnet.yaml
@@ -25,7 +25,8 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 20
     concurrency:
       group: ci-dotnet-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
diff --git a/.github/workflows/ci-frontend.yaml b/.github/workflows/ci-frontend.yaml
index 60c1035..630dd5a 100644
--- a/.github/workflows/ci-frontend.yaml
+++ b/.github/workflows/ci-frontend.yaml
@@ -47,7 +47,8 @@ permissions:
 jobs:
   guard:
     name: guard
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 10
     concurrency:
       group: ci-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}-guard
@@ -152,7 +153,8 @@ jobs:
 
   static:
     name: static
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}-static
@@ -177,7 +179,8 @@ jobs:
 
   build:
     name: build
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}-build
@@ -201,7 +204,8 @@ jobs:
 
   unit:
     name: unit (${{ matrix.shard }})
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}-unit-${{ matrix.shard }}
@@ -234,7 +238,8 @@ jobs:
   browser-smoke:
     name: browser-smoke
     if: ${{ inputs.run-e2e }}
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 20
     concurrency:
       group: ci-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}-browser-smoke
diff --git a/.github/workflows/ci-mobile-ios.yaml b/.github/workflows/ci-mobile-ios.yaml
index 5aa4c50..84c8f5e 100644
--- a/.github/workflows/ci-mobile-ios.yaml
+++ b/.github/workflows/ci-mobile-ios.yaml
@@ -119,7 +119,8 @@ permissions:
 
 jobs:
   js:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: ${{ inputs.js-timeout-minutes }}
     # cancel-in-progress is TRUE: superseding a push should abandon the older
     # CI run, which produces no external side effects.
diff --git a/.github/workflows/ci-python-app.yaml b/.github/workflows/ci-python-app.yaml
index bb41646..1263cd3 100644
--- a/.github/workflows/ci-python-app.yaml
+++ b/.github/workflows/ci-python-app.yaml
@@ -31,7 +31,8 @@ permissions:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 10
     # The trailing segment of every group in this file is the job id written
     # out literally, NOT `${{ github.job }}`. In a called workflow that
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index 0db0c69..a009ed8 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -49,7 +49,8 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 10
     concurrency:
       group: ci-python-sam-${{ github.workflow }}-${{ github.ref }}-${{ inputs.source-dirs }}
diff --git a/.github/workflows/ci-static.yaml b/.github/workflows/ci-static.yaml
index b8f5543..49c6675 100644
--- a/.github/workflows/ci-static.yaml
+++ b/.github/workflows/ci-static.yaml
@@ -61,7 +61,8 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-static-${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/ci-terraform.yaml b/.github/workflows/ci-terraform.yaml
index aab5637..9e3882d 100644
--- a/.github/workflows/ci-terraform.yaml
+++ b/.github/workflows/ci-terraform.yaml
@@ -48,7 +48,8 @@ permissions:
 jobs:
   terraform:
     name: terraform
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 15
     concurrency:
       group: ci-terraform-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index ad074ea..9b740ed 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -61,7 +61,8 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 30
     concurrency:
       group: ci-typescript-cdk-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
diff --git a/.github/workflows/ci-typescript-frontend.yaml b/.github/workflows/ci-typescript-frontend.yaml
index 733b137..f61905c 100644
--- a/.github/workflows/ci-typescript-frontend.yaml
+++ b/.github/workflows/ci-typescript-frontend.yaml
@@ -80,7 +80,8 @@ permissions:
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 30
     concurrency:
       group: ci-typescript-frontend-${{ github.workflow }}-${{ github.ref }}-${{ inputs.working-directory }}
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7f9ec16..13e0d39 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -51,7 +51,8 @@ permissions:
 jobs:
   isolation-tests:
     name: isolation-tests
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -66,7 +67,8 @@ jobs:
 
   actionlint:
     name: actionlint
-    runs-on: ubuntu-latest
+    # Org variable RUNNER_UBUNTU. seahaven-ubuntu when the pool can start a job, otherwise ubuntu-latest.
+    runs-on: "${{ vars.RUNNER_UBUNTU == 'seahaven-ubuntu' && 'seahaven-ubuntu' || 'ubuntu-latest' }}"
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1