diff --git a/.github/workflows/csharp-server.yml b/.github/workflows/csharp-server.yml
index 396449b..98c195e 100644
--- a/.github/workflows/csharp-server.yml
+++ b/.github/workflows/csharp-server.yml
@@ -5,20 +5,22 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-and-test:
     name: Repository policy, C# build and test
-    runs-on: [self-hosted, Linux, X64]
+    runs-on: [self-hosted, Linux, X64, co-server]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
 
       - name: Enforce repository runtime policy
         run: bash server/scripts/verify-no-legacy-runtime.sh
 
-      - uses: actions/setup-dotnet@v4
-        # The runner user cannot write to system /usr/share/dotnet; install the
-        # pinned SDK into a runner-writable, cached path instead. runner.* context
-        # is only valid at step scope, not job-level env.
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9
         env:
           DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
         with: