diff --git a/.github/workflows/ci-run.yml b/.github/workflows/ci-run.yml
index f2d3062ea..5b81dc82e 100644
--- a/.github/workflows/ci-run.yml
+++ b/.github/workflows/ci-run.yml
@@ -78,16 +78,20 @@ jobs:
         name: Workspace Check
         needs: [changes]
         if: needs.changes.outputs.rust_changed == 'true'
-        runs-on: [self-hosted, aws-india]
+        runs-on: ubuntu-22.04
         timeout-minutes: 45
         steps:
             - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+            - name: Self-heal Rust toolchain cache
+              shell: bash
+              run: ./scripts/ci/self_heal_rust_toolchain.sh 1.92.0
             - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
               with:
                   toolchain: 1.92.0
             - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v3
               with:
                   prefix-key: ci-run-workspace-check
+                  cache-bin: false
             - name: Check workspace
               run: cargo check --workspace --locked
 
@@ -95,7 +99,7 @@ jobs:
         name: Package Check (${{ matrix.package }})
         needs: [changes]
         if: needs.changes.outputs.rust_changed == 'true'
-        runs-on: [self-hosted, aws-india]
+        runs-on: ubuntu-22.04
         timeout-minutes: 25
         strategy:
             fail-fast: false
@@ -103,12 +107,16 @@ jobs:
                 package: [zeroclaw-types, zeroclaw-core]
         steps:
             - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+            - name: Self-heal Rust toolchain cache
+              shell: bash
+              run: ./scripts/ci/self_heal_rust_toolchain.sh 1.92.0
             - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
               with:
                   toolchain: 1.92.0
             - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v3
               with:
                   prefix-key: ci-run-package-check
+                  cache-bin: false
             - name: Check package
               run: cargo check -p ${{ matrix.package }} --locked
 
diff --git a/crates/zeroclaw-core/src/lib.rs b/crates/zeroclaw-core/src/lib.rs
index 74b9ee3d2..9040040b8 100644
--- a/crates/zeroclaw-core/src/lib.rs
+++ b/crates/zeroclaw-core/src/lib.rs
@@ -1,3 +1,5 @@
+#![forbid(unsafe_code)]
+
 //! Core contracts for the staged workspace split.
 //!
 //! This crate is intentionally minimal in PR-1 (scaffolding only).
diff --git a/crates/zeroclaw-types/src/lib.rs b/crates/zeroclaw-types/src/lib.rs
index 2b4288779..95c3cf66a 100644
--- a/crates/zeroclaw-types/src/lib.rs
+++ b/crates/zeroclaw-types/src/lib.rs
@@ -1,3 +1,5 @@
+#![forbid(unsafe_code)]
+
 //! Shared foundational types for the staged workspace split.
 //!
 //! This crate is intentionally minimal in PR-1 (scaffolding only).