diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index 4865fa5..f9e7259 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -11,6 +11,7 @@ on:
 permissions:
   contents: write
   id-token: write
+  packages: read
   pull-requests: write
 
 jobs:
@@ -20,9 +21,8 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
     uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
     with:
-      # Native tfroot-runner scale set in kustomize-cluster/workloads/arc.
-      # The runner pod IS the tfroot-runner image — no nested container.
-      runs-on: arc-tf
+      runs-on: libvirt
+      container-image: ghcr.io/makeitworkcloud/tfroot-runner:ec03fa08b93cccc48c327d0b2b7aeb4f212000f7
       setup-ssh: true
     secrets:
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}