diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 617d7fa..ee068e6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -50,9 +50,11 @@ test-integration:
 
 publish:
   extends: .node-common
-  # npm trusted publishing via GitLab OIDC — no NPM_TOKEN needed.
+  # npm trusted publishing via GitLab OIDC — requires instance runner for OIDC support.
   # Each @wizardconnect/* package must be linked to this GitLab project
   # on npmjs.com: package Settings > Publishing access > Trusted publishers.
+  tags:
+    - saas-linux-small-amd64 # force gitlab instance runner
   id_tokens:
     SIGSTORE_ID_TOKEN:
       aud: sigstore
@@ -85,6 +87,8 @@ pages:
 
 force-publish:
   extends: .node-common
+  tags:
+    - saas-linux-small-amd64 # force gitlab instance runners
   id_tokens:
     SIGSTORE_ID_TOKEN:
       aud: sigstore