diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0da062..cc48c39 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+- Align the NDDev runner-routing example and `fleet_contract` with official
+  `nddev-linux` slots (`github-actions-light`). The previous GARM/Incus
+  container contract is no longer the public current contract.
+
 ## [0.1.17] - 2026-09-15
 
 - Re-verify GitLab Free and Open Source allowances against current primary
diff --git a/docs/05-runners.md b/docs/05-runners.md
index 5db6aff..3a9c427 100644
--- a/docs/05-runners.md
+++ b/docs/05-runners.md
@@ -277,9 +277,9 @@ estate-neutral declaration with an operator mapping. The NDDev example is
 | Requested route | Concrete backend |
 | --- | --- |
 | Linux `hosted` | `ubuntu-latest`, standard GitHub-hosted/public-safe |
-| Linux `fast` | `nddev-linux-fast`, shell-only |
-| Linux `standard` | `nddev-linux-standard`, normal build/test |
-| Linux `integration` | `nddev-linux-integration`, container runtime |
+| Linux `fast` | `nddev-linux`, official persistent `actions/runner` |
+| Linux `standard` | `nddev-linux`, official persistent `actions/runner` |
+| Linux `integration` | `nddev-linux` with Docker, official persistent `actions/runner` |
 | macOS `hosted` | `macos-latest`, standard GitHub-hosted |
 | Windows `hosted` | `windows-latest`, standard GitHub-hosted |
 
diff --git a/examples/nddev/os-capability-routing.yml b/examples/nddev/os-capability-routing.yml
index fe133f0..a59cea1 100644
--- a/examples/nddev/os-capability-routing.yml
+++ b/examples/nddev/os-capability-routing.yml
@@ -14,17 +14,17 @@ jobs:
     permissions: { contents: read }
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@<sha>
     with:
-      runner: nddev-linux-fast
+      runner: nddev-linux
   linux-standard:
     permissions: { contents: read }
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@<sha>
     with:
-      runner: nddev-linux-standard
+      runner: nddev-linux
   linux-integration:
     permissions: { contents: read }
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@<sha>
     with:
-      runner: nddev-linux-integration
+      runner: nddev-linux
   macos-hosted:
     permissions: { contents: read }
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/go-ci.yml@<sha>
diff --git a/scripts/check_runner_routing.py b/scripts/check_runner_routing.py
index cf36932..c65d43e 100644
--- a/scripts/check_runner_routing.py
+++ b/scripts/check_runner_routing.py
@@ -20,12 +20,12 @@
 VISIBILITIES = {"public", "private", "internal"}
 KNOWN_CAPABILITIES = {"container-runtime"}
 FLEET_CONTRACT = {
-    "repository": "NDDev-OpenNetwork/github-actions",
-    "minimum_contract_version": 2,
-    "worker_kind": "incus-container",
-    "ephemeral": True,
+    "repository": "NDDev-OpenNetwork/github-actions-light",
+    "minimum_contract_version": 1,
+    "worker_kind": "official-actions-runner",
+    "ephemeral": False,
     "jobs_per_worker": 1,
-    "executed_worker_disposition": "destroy",
+    "executed_worker_disposition": "persist",
 }
 
 
@@ -227,9 +227,9 @@ def check() -> list[str]:
         return problems
 
     positive = (
-        (".github/workflows/actionlint.yml", "linux", "fast", "private", "nddev-linux-fast"),
-        (".github/workflows/go-ci.yml", "linux", "standard", "private", "nddev-linux-standard"),
-        (".github/workflows/secret-scan.yml", "linux", "integration", "private", "nddev-linux-integration"),
+        (".github/workflows/actionlint.yml", "linux", "fast", "private", "nddev-linux"),
+        (".github/workflows/go-ci.yml", "linux", "standard", "private", "nddev-linux"),
+        (".github/workflows/secret-scan.yml", "linux", "integration", "private", "nddev-linux"),
         (".github/workflows/go-ci.yml", "macos", "hosted", "private", "macos-latest"),
         (".github/workflows/go-ci.yml", "windows", "hosted", "private", "windows-latest"),
         (".github/workflows/swift-ci.yml", "macos", "hosted", "public", "macos-latest"),
@@ -270,9 +270,9 @@ def check() -> list[str]:
     caller_path = REPO_ROOT / "examples" / "nddev" / "os-capability-routing.yml"
     caller = strict_load(caller_path)
     caller_expectations = {
-        "linux-fast": (".github/workflows/actionlint.yml", "nddev-linux-fast"),
-        "linux-standard": (".github/workflows/go-ci.yml", "nddev-linux-standard"),
-        "linux-integration": (".github/workflows/secret-scan.yml", "nddev-linux-integration"),
+        "linux-fast": (".github/workflows/actionlint.yml", "nddev-linux"),
+        "linux-standard": (".github/workflows/go-ci.yml", "nddev-linux"),
+        "linux-integration": (".github/workflows/secret-scan.yml", "nddev-linux"),
         "macos-hosted": (".github/workflows/go-ci.yml", "macos-latest"),
         "windows-hosted": (".github/workflows/go-ci.yml", "windows-latest"),
     }