diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 05806ce..361e70f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -6,15 +6,14 @@ on:
 
 jobs:
   check:
-    # Not brick-build: that label's job container (opensuse/leap:16.0) has
-    # no Node.js, and every step below (checkout, setup-ruby, setup-node)
-    # is a JS-based Action that needs it to even start — see the run that
-    # failed immediately on 2026-09-12. ubuntu-latest is shared with
-    # "Gitea Runner on Cube" too (not pinned to this machine specifically),
-    # but that's fine here: only deploy (runs-on: brick-host, a unique
-    # label held by just the native runner on brick) actually needs to
-    # land on a specific box.
-    runs-on: ubuntu-latest
+    # brick-build's job container now points at Gitea's own official
+    # runner image (docker.gitea.com/runner-images:ubuntu-latest, has
+    # Node out of the box) — the earlier opensuse/leap:16.0 image that
+    # failed here on 2026-09-12 (no Node, every step below is a JS-based
+    # Action) got repointed. Pinned to brick specifically again, rather
+    # than the shared ubuntu-latest label "Gitea Runner on Cube" also
+    # answers to.
+    runs-on: brick-build
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 5223107..ad498b7 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -9,8 +9,9 @@ on:
 jobs:
   renovate:
     # Same reasoning as check's runs-on in ci.yml: brick-build's job
-    # container has no Node, which setup-node/npm below need.
-    runs-on: ubuntu-latest
+    # container now has Node (repointed at Gitea's own official runner
+    # image), which setup-node/npm below need.
+    runs-on: brick-build
     steps:
       - name: Setup Node
         uses: actions/setup-node@v4
diff --git a/docs/deployment.adoc b/docs/deployment.adoc
index 7d6880e..6d0e30a 100644
--- a/docs/deployment.adoc
+++ b/docs/deployment.adoc
@@ -7,16 +7,19 @@ MapTool deploys as a Podman container (via `podman compose`, driven by a
 the Gitea Actions runners run on. Two separate runners are registered
 against the Gitea instance:
 
-* The existing Docker-based runner (`gitea/runner:3`), labels
-  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04` — runs the `check` and
-  `renovate` jobs in a fresh, isolated container per job, same as
-  before. It's also registered under `brick-build`, but that label's
-  job container (`opensuse/leap:16.0`) has no Node.js, which every step
-  in `check`/`renovate` needs (they're JS-based Actions) — until that
-  image gets Node, or the label points elsewhere, `check`/`renovate`
-  stay on `ubuntu-latest`. That label is shared with "Gitea Runner on
-  Cube" too, so a `check`/`renovate` run isn't pinned to this specific
-  machine — harmless, since only `deploy` actually needs a specific box.
+* The existing Docker-based runner (`gitea/runner:3`), label
+  `brick-build` — runs the `check` and `renovate` jobs in a fresh,
+  isolated container per job. Every label on this runner (including
+  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04`, still registered but no
+  longer what `check`/`renovate` pin to) now maps to Gitea's own
+  official runner image (`docker.gitea.com/runner-images:ubuntu-latest`,
+  has Node out of the box) — an earlier `opensuse/leap:16.0` mapping for
+  `brick-build` specifically had no Node, which every step in
+  `check`/`renovate` needs (they're JS-based Actions), and briefly broke
+  both jobs (2026-09-12) until reverted to the shared `ubuntu-latest`
+  label; now that the image itself is fixed, both are pinned back to
+  `brick-build` — this machine specifically, not whichever runner
+  happens to answer to the shared label (e.g. "Gitea Runner on Cube").
 * A dedicated native runner, installed directly on the host (no Docker
   around it), label `brick-host` — runs only the `deploy` job.