diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5d9fb9..8fff149 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   lint:
     name: 🧹 Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -39,7 +39,7 @@ jobs:
 
   deps:
     name: 📦 Dependencies
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -62,7 +62,7 @@ jobs:
 
   format:
     name: 🎨 Format
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -93,7 +93,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "windows-latest"]') }}
+        os: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["ubuntu-slim"]') || fromJSON('["ubuntu-slim", "macos-latest", "windows-latest"]') }}
         go: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["stable"]') || fromJSON('["stable", "oldstable"]') }}
     steps:
       - name: 📥 Checkout
@@ -115,6 +115,7 @@ jobs:
       - lint
       - deps
       - test
+    # go-test-coverage is a container action, and ubuntu-slim has no Docker daemon.
     runs-on: ubuntu-latest
     steps:
       - name: 📥 Checkout
@@ -146,7 +147,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest", "windows-latest"]') }}
+        os: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["ubuntu-slim"]') || fromJSON('["ubuntu-slim", "macos-latest", "windows-latest"]') }}
         go: ${{ (github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release-run')) && fromJSON('["stable"]') || fromJSON('["stable", "oldstable"]') }}
     steps:
       - name: 📥 Checkout
diff --git a/.github/workflows/cleanup-deployments.yml b/.github/workflows/cleanup-deployments.yml
index 348e7dd..c5b52c3 100644
--- a/.github/workflows/cleanup-deployments.yml
+++ b/.github/workflows/cleanup-deployments.yml
@@ -27,7 +27,7 @@ permissions:
 jobs:
   cleanup:
     name: Delete old deployments
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb4f0c7..afea6ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   build-and-upload:
     name: Build and upload binaries
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     strategy:
       fail-fast: false
       matrix:
@@ -50,7 +50,7 @@ jobs:
 
   create-release:
     needs: build-and-upload
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -74,6 +74,7 @@ jobs:
 
   build-and-push-image:
     name: Build and push Docker image (GHCR)
+    # ubuntu-slim cannot run a Docker daemon, so the image build stays on a full VM.
     runs-on: ubuntu-latest
     steps:
       - name: Checkout