diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index b6b4c32..963c523 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -16,6 +16,13 @@
 # stable release. forgejo-release creates the release (from the checked-out
 # sha) if it does not exist, and `override: true` lets a re-run replace the
 # assets.
+#
+# Runner topology. There is one self-hosted runner registered `linux-amd64`
+# with `:host` execution -- jobs run directly on the host, not in a
+# container. The host already provides node, git, rustup/cargo, hurl, and the
+# aarch64 cross linker, so the workflow uses them in place rather than
+# installing anything (the host user has no passwordless sudo). Both targets
+# build on this one amd64 host: x86_64 natively, aarch64 by cross-compilation.
 name: build
 
 on:
@@ -35,73 +42,83 @@ permissions:
   contents: write
 
 jobs:
+  # Single test gate for both targets. The suite and the HTTP contract
+  # harness are architecture-independent, so they run once, natively on the
+  # amd64 host. Both build jobs depend on this, so a release never ships a
+  # red build.
+  test:
+    name: test
+    runs-on: linux-amd64
+    steps:
+      - name: Check out the workflow ref
+        uses: actions/checkout@v4
+
+      # The :host runner runs each step in a non-login shell that does not
+      # source ~/.cargo/env, so rustup/cargo are not on PATH. Source it in
+      # each step that needs the toolchain -- self-contained, no reliance on
+      # GITHUB_PATH propagating across steps.
+      - name: Run the Rust test suite
+        run: |
+          source "$HOME/.cargo/env"
+          cargo test --locked
+
+      # The HTTP contract harness (tests/run-hurl.sh, per ADR-008) boots
+      # `anwesen serve` and runs hurl against it -- headless, so it runs in CI.
+      # hurl is on the host PATH; the harness builds anwesen, so cargo too.
+      - name: Run the HTTP contract tests
+        run: |
+          source "$HOME/.cargo/env"
+          tests/run-hurl.sh
+
   build:
     name: ${{ matrix.label }}
-    # NOTE: these labels must match the labels your act_runner registered
-    # with -- adjust to your forge's runner topology. `linux-amd64` assumes a
-    # Linux host with a C toolchain (cc/ld) for the native build; `macos-arm64`
-    # assumes a native Apple Silicon macOS runner. There is no GitHub-hosted
-    # macOS on a self-hosted forge, so the arm64 build needs a registered Mac.
-    runs-on: ${{ matrix.runner }}
+    needs: test
+    runs-on: linux-amd64
     strategy:
       # One target's failure should not cancel the other's build.
       fail-fast: false
       matrix:
         include:
-          # amd64 Linux -- the deploy target. Built natively.
-          - runner: linux-amd64
+          # amd64 Linux -- the deploy target. Built natively for the host.
+          - target: x86_64-unknown-linux-gnu
             label: x86_64-linux
-            os: linux
-          # arm macOS (apple silicon) -- aav's local machine. Built natively.
-          - runner: macos-arm64
-            label: aarch64-macos
-            os: macos
+          # arm64 Linux -- cross-compiled on the same amd64 host. cross-rs
+          # would need a container engine the host runner does not provide
+          # (and cannot target apple-darwin from Linux anyway), so this uses
+          # the rustup target plus the host's aarch64-linux-gnu-gcc linker.
+          - target: aarch64-unknown-linux-gnu
+            label: aarch64-linux
+    env:
+      # cargo picks the linker for the aarch64 target from this; the host
+      # already provides aarch64-linux-gnu-gcc. Harmless for the amd64 target.
+      CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
     steps:
       - name: Check out the workflow ref
         uses: actions/checkout@v4
 
-      # Stable channel; edition 2024 needs >= 1.85, and Cargo.toml pins the
-      # MSRV at 1.95. Pin an explicit version here if a frozen release
-      # toolchain is ever required.
-      - name: Install the Rust toolchain
-        uses: https://github.com/dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo registry, index, and target
-        uses: https://github.com/Swatinem/rust-cache@v2
-
-      # The HTTP contract harness (tests/run-hurl.sh, per ADR-008) boots
-      # `anwesen serve` and runs hurl against it -- headless, so it runs in CI.
-      # The HTTP contract is arch-independent, so it runs once on Linux; the
-      # macOS runner's stock bash is 3.2 and the harness needs bash 4+
-      # (`shopt -s globstar`), which would only add fragility for no extra
-      # coverage.
-      - name: Install hurl
-        if: matrix.os == 'linux'
+      # See the test job: source the host toolchain in each step rather than
+      # rely on GITHUB_PATH. The host toolchain is rustup-managed; ensure the
+      # cross target's std is present (idempotent for the native target).
+      - name: Add the Rust target
         run: |
-          curl -fsSL -o /tmp/hurl.deb \
-            https://github.com/Orange-OpenSource/hurl/releases/download/8.0.0/hurl_8.0.0_amd64.deb
-          sudo dpkg -i /tmp/hurl.deb
-
-      # Test before building the artifact so a release never ships a red build.
-      # The debug build here is what run-hurl.sh exercises.
-      - name: Run the Rust test suite
-        run: cargo test --locked
-
-      - name: Run the HTTP contract tests
-        if: matrix.os == 'linux'
-        run: tests/run-hurl.sh
+          source "$HOME/.cargo/env"
+          rustup target add ${{ matrix.target }}
 
       - name: Build the release binary
-        run: cargo build --release --locked
+        run: |
+          source "$HOME/.cargo/env"
+          cargo build --release --locked --target ${{ matrix.target }}
 
-      # The runner is native to its target, so target/release/anwesen is the
-      # target binary. forgejo-release uploads everything under the release
-      # dir, so the staged name is the asset name -- make the target explicit.
+      # forgejo-release uploads everything under the release dir, so the
+      # staged name is the asset name -- make the target explicit. The tag
+      # goes through env, not direct interpolation into the run body.
       - name: Stage the asset for its target
+        env:
+          TAG: ${{ inputs.tag }}
         run: |
           mkdir -p dist/release
-          install -m 0755 target/release/anwesen \
-            "dist/release/anwesen-${{ inputs.tag }}-${{ matrix.label }}"
+          install -m 0755 "target/${{ matrix.target }}/release/anwesen" \
+            "dist/release/anwesen-${TAG}-${{ matrix.label }}"
 
       - name: Publish the binary to the Forgejo release
         uses: https://code.forgejo.org/actions/forgejo-release@v2
diff --git a/scratch-runner.log b/scratch-runner.log
new file mode 100644
index 0000000..dd2b9b0
--- /dev/null
+++ b/scratch-runner.log
@@ -0,0 +1,8 @@
+time="2026-06-24T00:11:23+03:00" level=info msg="No configuration file specified; using default settings."
+time="2026-06-24T00:11:23+03:00" level=info msg="Starting runner daemon"
+time="2026-06-24T00:11:24+03:00" level=info msg="runner: ws-brn, with version: v12.12.0, with labels: [linux-amd64 ws-brn], ephemeral: false, declared successfully"
+time="2026-06-24T00:11:24+03:00" level=info msg="[poller] launched"
+time="2026-06-24T00:17:52+03:00" level=info msg="task 1 repo is carvers/anwesen https://data.forgejo.org https://forge.crvrs.org"
+time="2026-06-24T00:21:10+03:00" level=info msg="task 2 repo is carvers/anwesen https://data.forgejo.org https://forge.crvrs.org"
+time="2026-06-24T00:21:38+03:00" level=info msg="task 3 repo is carvers/anwesen https://data.forgejo.org https://forge.crvrs.org"
+time="2026-06-24T00:21:44+03:00" level=info msg="task 4 repo is carvers/anwesen https://data.forgejo.org https://forge.crvrs.org"