diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 750a79e..9c561ba 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -12,7 +12,7 @@ on:
 
 jobs:
   build-web:
-    runs-on: fabledcurator-ci
+    runs-on: python-ci
     steps:
       - uses: actions/checkout@v4
 
@@ -41,7 +41,7 @@ jobs:
           tags: ${{ steps.tag.outputs.tags }}
 
   build-ml:
-    runs-on: fabledcurator-ci
+    runs-on: python-ci
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 28ca052..ce48fa3 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -8,9 +8,10 @@ on:
 
 jobs:
   backend-lint-and-test:
-    # Runner must have Python 3.14 + ruff installed. Provision a runner
-    # labeled "fabledcurator-ci" with Python 3.14, ruff, and Node 22.
-    runs-on: fabledcurator-ci
+    # Runner must have Python 3.14 + ruff + Node 22 pre-installed. The
+    # python-ci runner image lives at CI-Runner/CI-python/ in the operator's
+    # workspace; see that Dockerfile + Makefile to roll/push the image.
+    runs-on: python-ci
     services:
       postgres:
         image: pgvector/pgvector:pg16
@@ -55,7 +56,7 @@ jobs:
         run: pytest tests/ -v
 
   frontend-build:
-    runs-on: fabledcurator-ci
+    runs-on: python-ci
     defaults:
       run:
         working-directory: frontend
diff --git a/README.md b/README.md
index 0ee52da..371a801 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ FabledCurator is designed to run inside a self-hosted homelab environment over p
 
 The repo's workflows expect:
 
-- **Runner label `fabledcurator-ci`** — a Forgejo runner with Python 3.14, ruff, and Node 22 pre-installed. Both `ci.yml` and `build.yml` use this label.
+- **Runner label `python-ci`** — a Forgejo runner with Python 3.14, ruff, and Node 22 pre-installed. Both `ci.yml` and `build.yml` use this label. The runner image (`runner-base:python-ci`) is built from `CI-Runner/CI-python/` in the operator's workspace; `make push` from that directory builds and pushes a new image when toolchain pins change.
 - **Repo secret `RELEASE_TOKEN`** — a Forgejo PAT with the following scopes:
   - `write:package` + `read:package` — for `docker push` to `git.fabledsword.com`
   - `write:release` — for future release-cutting workflows