diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e8fffbc..05806ce 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -6,7 +6,15 @@ on:
 
 jobs:
   check:
-    runs-on: brick-build
+    # Not brick-build: that label's job container (opensuse/leap:16.0) has
+    # no Node.js, and every step below (checkout, setup-ruby, setup-node)
+    # is a JS-based Action that needs it to even start — see the run that
+    # failed immediately on 2026-09-12. ubuntu-latest is shared with
+    # "Gitea Runner on Cube" too (not pinned to this machine specifically),
+    # but that's fine here: only deploy (runs-on: brick-host, a unique
+    # label held by just the native runner on brick) actually needs to
+    # land on a specific box.
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index dba023b..5223107 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -8,7 +8,9 @@ on:
 
 jobs:
   renovate:
-    runs-on: brick-build
+    # Same reasoning as check's runs-on in ci.yml: brick-build's job
+    # container has no Node, which setup-node/npm below need.
+    runs-on: ubuntu-latest
     steps:
       - name: Setup Node
         uses: actions/setup-node@v4
diff --git a/docs/deployment.adoc b/docs/deployment.adoc
index a93592d..7d6880e 100644
--- a/docs/deployment.adoc
+++ b/docs/deployment.adoc
@@ -7,9 +7,16 @@ MapTool deploys as a Podman container (via `podman compose`, driven by a
 the Gitea Actions runners run on. Two separate runners are registered
 against the Gitea instance:
 
-* The existing Docker-based runner (`gitea/runner:3`), label
-  `brick-build` — runs the `check` and `renovate` jobs in a fresh,
-  isolated container per job, same as before.
+* The existing Docker-based runner (`gitea/runner:3`), labels
+  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04` — runs the `check` and
+  `renovate` jobs in a fresh, isolated container per job, same as
+  before. It's also registered under `brick-build`, but that label's
+  job container (`opensuse/leap:16.0`) has no Node.js, which every step
+  in `check`/`renovate` needs (they're JS-based Actions) — until that
+  image gets Node, or the label points elsewhere, `check`/`renovate`
+  stay on `ubuntu-latest`. That label is shared with "Gitea Runner on
+  Cube" too, so a `check`/`renovate` run isn't pinned to this specific
+  machine — harmless, since only `deploy` actually needs a specific box.
 * A dedicated native runner, installed directly on the host (no Docker
   around it), label `brick-host` — runs only the `deploy` job.