diff --git a/.github/workflows/publish-host.yml b/.github/workflows/publish-host.yml
index cce5438..e770328 100644
--- a/.github/workflows/publish-host.yml
+++ b/.github/workflows/publish-host.yml
@@ -1,37 +1,34 @@
 name: Publish Host (Avalonia)
 
-# Produces self-contained, single-file Server Host binaries for Windows and
-# Linux. No .NET runtime is required on the target machine. Runs on demand and
-# on version tags; each build is uploaded as a workflow artifact.
-
 on:
   workflow_dispatch:
   push:
     tags:
       - "host-v*"
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Publish ${{ matrix.rid }}
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: [self-hosted, Linux, X64, co-server]
     strategy:
       fail-fast: false
       matrix:
         rid: [win-x64, linux-x64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-dotnet@v4
-        # The runner user cannot write to system /usr/share/dotnet; install the
-        # pinned SDK into a runner-writable, cached path instead.
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
         env:
           DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
         with:
           dotnet-version: "8.0.x"
 
       - name: Publish single-file self-contained
-        # Untrimmed on purpose: the host uses reflection-based Avalonia bindings,
-        # which the trimmer would strip.
         run: >
           dotnet publish host/CommonwealthOnline.Host.csproj
           -c Release
@@ -44,8 +41,9 @@ jobs:
           --nologo
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: CommonwealthOnline.Host-${{ matrix.rid }}
           path: out/${{ matrix.rid }}/
           if-no-files-found: error
+          retention-days: 7