diff --git a/.github/workflows/secret-guardrails.yml b/.github/workflows/secret-guardrails.yml
index 71691e7..03c4c92 100644
--- a/.github/workflows/secret-guardrails.yml
+++ b/.github/workflows/secret-guardrails.yml
@@ -3,10 +3,11 @@ name: secret-guardrails
 on:
   push:
   pull_request:
+  workflow_dispatch:
 
 jobs:
   artifact-secret-scan:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, nomad, truenas-stacks]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4
@@ -20,7 +21,7 @@ jobs:
         run: scripts/scan-secret-bearing-artifacts.sh --tracked
 
   gitleaks:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, nomad, truenas-stacks]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4