diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1d7adc3f6ad..5767da0af21 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}-${{ matrix.language }}
       cancel-in-progress: true
diff --git a/.github/workflows/first-time-pr.yml b/.github/workflows/first-time-pr.yml
index d3dbf306c8f..c09bed136e0 100644
--- a/.github/workflows/first-time-pr.yml
+++ b/.github/workflows/first-time-pr.yml
@@ -26,7 +26,7 @@ jobs:
     name: Welcome first-time contributor
     permissions:
       pull-requests: write # for gh pr edit --add-label and posting the welcome comment
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     if: >-
       github.event.action == 'opened' &&
       github.repository_owner == 'open-telemetry' &&
diff --git a/.github/workflows/promote-pull-request-dashboard.yml b/.github/workflows/promote-pull-request-dashboard.yml
index 053e6c76539..ff8254fd57d 100644
--- a/.github/workflows/promote-pull-request-dashboard.yml
+++ b/.github/workflows/promote-pull-request-dashboard.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   promote:
     name: Open stable promotion pull request
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - name: Enforce main branch
         env:
diff --git a/.github/workflows/pull-request-dashboard-deploy-webhook.yml b/.github/workflows/pull-request-dashboard-deploy-webhook.yml
index fa52b2185fc..637d70dcfcc 100644
--- a/.github/workflows/pull-request-dashboard-deploy-webhook.yml
+++ b/.github/workflows/pull-request-dashboard-deploy-webhook.yml
@@ -24,7 +24,7 @@ concurrency:
 jobs:
   deploy:
     if: github.repository == 'open-telemetry/shared-workflows'
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     environment: protected
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/pull-request-dashboard-drain.yml b/.github/workflows/pull-request-dashboard-drain.yml
index 6e71491c4dd..117aef28567 100644
--- a/.github/workflows/pull-request-dashboard-drain.yml
+++ b/.github/workflows/pull-request-dashboard-drain.yml
@@ -26,7 +26,7 @@ jobs:
       copilot-requests: write
       id-token: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     timeout-minutes: 50
     env:
       DISPATCHER_GENERATION: ${{ inputs.dispatcher_generation }}
diff --git a/.github/workflows/pull-request-dashboard-repo.yml b/.github/workflows/pull-request-dashboard-repo.yml
index 4281f784c57..e38f55b7396 100644
--- a/.github/workflows/pull-request-dashboard-repo.yml
+++ b/.github/workflows/pull-request-dashboard-repo.yml
@@ -42,7 +42,7 @@ jobs:
       contents: write
       copilot-requests: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     outputs:
       initial_backfill_complete: ${{ steps.dashboard-update.outputs.initial_backfill_complete }}
     steps:
@@ -227,7 +227,7 @@ jobs:
     permissions:
       contents: write
     environment: protected
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     timeout-minutes: 50
     env:
       PUBLISHER_LOCK_OWNER: ${{ github.run_id }}-${{ github.run_attempt }}-publish
diff --git a/.github/workflows/pull-request-dashboard-test.yml b/.github/workflows/pull-request-dashboard-test.yml
index 85f75c42a1c..8d8ec7ee70d 100644
--- a/.github/workflows/pull-request-dashboard-test.yml
+++ b/.github/workflows/pull-request-dashboard-test.yml
@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/pull-request-dashboard.yml b/.github/workflows/pull-request-dashboard.yml
index 159b5ba0ba1..671b3e96472 100644
--- a/.github/workflows/pull-request-dashboard.yml
+++ b/.github/workflows/pull-request-dashboard.yml
@@ -49,7 +49,7 @@ jobs:
     # Targeted refreshes go straight to the reusable workflow, which resolves
     # its own configuration. Only backfills need a matrix resolved up front.
     if: inputs.head_sha == '' && (inputs.repository == '' || inputs.pr_number == '')
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     environment: protected
@@ -115,7 +115,7 @@ jobs:
     # Check and status events for a fork head carry no pull request number, so
     # the head commit has to be resolved before the reusable workflow runs.
     if: inputs.head_sha != '' && inputs.pr_number == ''
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: read
     environment: protected
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 862ea7667fd..d5a9f39f036 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   release:
     name: Cut new release
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     permissions:
       contents: write # to create the tag and the GitHub Release
     steps:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3babc9cb99a..1869e17bdac 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -25,7 +25,7 @@ jobs:
   # https://github.com/ossf/scorecard-action#workflow-restrictions
   analysis:
     name: OSSF Scorecard Analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read # for actions/checkout
       id-token: write # Needed for GitHub OIDC token since publish_results is true
@@ -52,7 +52,7 @@ jobs:
   upload:
     name: Upload to code scanning
     needs: analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read # for actions/checkout, so that upload-sarif can fingerprint results
       security-events: write # Needed for Code scanning upload
diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml
index bdc9301d899..db1c7aec6b5 100644
--- a/.github/workflows/survey-on-merged-pr.yml
+++ b/.github/workflows/survey-on-merged-pr.yml
@@ -23,7 +23,7 @@ env:
 jobs:
   comment-on-pr:
     name: Add survey to PR if author is not a member
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     if: >-
       github.event.pull_request.merged == true &&
       github.repository_owner == 'open-telemetry' &&
diff --git a/.github/workflows/workflow-failure-issue.yml b/.github/workflows/workflow-failure-issue.yml
index cb3ae7a241c..c15465f28eb 100644
--- a/.github/workflows/workflow-failure-issue.yml
+++ b/.github/workflows/workflow-failure-issue.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'open-telemetry'
     permissions:
       issues: write # needed to open, comment on, and close workflow failure issues
-    runs-on: cncf-ubuntu-2-8-x86
+    runs-on: ubuntu-latest
     steps:
       - name: Open issue or add comment if issue already open
         env:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index df25d570497..88376db0126 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -34,7 +34,7 @@ concurrency:
 jobs:
   zizmor:
     name: Zizmor Security Analysis
-    runs-on: ${{ (github.repository == 'open-telemetry/shared-workflows' || inputs['use-cncf-hosted-runner']) && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs['use-cncf-hosted-runner'] && 'cncf-ubuntu-2-8-x86' || 'ubuntu-latest' }}
     permissions:
       contents: read
       security-events: write  # for zizmor to upload SARIF results
diff --git a/scorecard/README.md b/scorecard/README.md
index fad8cbbee13..ad5eb21d810 100644
--- a/scorecard/README.md
+++ b/scorecard/README.md
@@ -31,7 +31,7 @@ jobs:
 
 Pin `<sha-or-tag>` to a commit SHA or release tag in this repository. No secrets are required.
 
-For reusable workflow callers, the optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, both Scorecard jobs run on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, both jobs run on `ubuntu-latest`. Runs triggered directly in `open-telemetry/shared-workflows` always use `cncf-ubuntu-2-8-x86`. The mapping is fixed; callers cannot provide another runner label.
+The optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, both Scorecard jobs run on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, both jobs run on `ubuntu-latest`. Runs triggered directly in this repository use `ubuntu-latest`. The mapping is fixed; callers cannot provide another runner label.
 
 ## What gets filtered
 
diff --git a/zizmor/README.md b/zizmor/README.md
index 81b4bf19863..998c1edeea0 100644
--- a/zizmor/README.md
+++ b/zizmor/README.md
@@ -32,7 +32,7 @@ jobs:
 
 Pin `<sha-or-tag>` to a commit SHA or release tag in this repository. No secrets are required. The workflow uses zizmor's `regular` persona by default.
 
-For reusable workflow callers, the optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, the Zizmor job runs on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, the job runs on `ubuntu-latest`. Runs triggered directly in `open-telemetry/shared-workflows` always use `cncf-ubuntu-2-8-x86`. The mapping is fixed; callers cannot provide another runner label.
+The optional Boolean `use-cncf-hosted-runner` input defaults to `false`. When it is `true`, the Zizmor job runs on `cncf-ubuntu-2-8-x86`; when it is `false` or omitted, the job runs on `ubuntu-latest`. Runs triggered directly in this repository use `ubuntu-latest`. The mapping is fixed; callers cannot provide another runner label.
 
 To use a different persona, pass the `persona` input: