diff --git a/.github/workflows/attach-artifacts.yml b/.github/workflows/attach-artifacts.yml
index 1cb57116958..3a048395d56 100644
--- a/.github/workflows/attach-artifacts.yml
+++ b/.github/workflows/attach-artifacts.yml
@@ -9,7 +9,8 @@ on:
 
 jobs:
   upload-assets:
-    runs-on: spacetimedb-linux
+    # This only downloads existing artifacts and attaches them to a GitHub release.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: write  # needed to modify releases
 
@@ -60,4 +61,3 @@ jobs:
           gh release upload "$RELEASE_TAG" ./* \
             --repo "$GITHUB_REPOSITORY" \
             --clobber
-
diff --git a/.github/workflows/check-merge-labels.yml b/.github/workflows/check-merge-labels.yml
index 2c3f14abb57..4a6540ed1f3 100644
--- a/.github/workflows/check-merge-labels.yml
+++ b/.github/workflows/check-merge-labels.yml
@@ -10,7 +10,8 @@ permissions: read-all
 jobs:
   label_checks:
     name: Check merge labels
-    runs-on: spacetimedb-linux
+    # This only inspects event labels and performs no checkout or build.
+    runs-on: spacetimedb-linux-small
     steps:
       - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'do not merge')
         run: |
diff --git a/.github/workflows/check-pr-base.yml b/.github/workflows/check-pr-base.yml
index 818cb4df966..90801f72e02 100644
--- a/.github/workflows/check-pr-base.yml
+++ b/.github/workflows/check-pr-base.yml
@@ -13,7 +13,8 @@ concurrency:
 jobs:
   check_base_ref:
     name: Based on `master`
-    runs-on: spacetimedb-linux
+    # This only evaluates the event base ref and performs no build.
+    runs-on: spacetimedb-linux-small
     steps:
       - id: not_based_on_master
         if: |
@@ -26,7 +27,8 @@ jobs:
   release_dependencies:
     if: ${{ github.event_name == 'pull_request' }}
     name: Check release dependencies
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and inspects release metadata and git history.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f7a1d9ee0c..0e82ae6f4d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,8 @@ permissions:
 jobs:
   merge_queue_noop:
     name: Merge queue no-op/reuse
-    runs-on: spacetimedb-linux
+    # This compares git trees and builds only the small workflow-coordinator helper.
+    runs-on: spacetimedb-linux-small
     permissions:
       actions: write
       contents: read
@@ -560,7 +561,8 @@ jobs:
           - name: Windows 2/4
           - name: Windows 3/4
           - name: Windows 4/4
-    runs-on: spacetimedb-linux
+    # These no-op jobs only preserve required smoketest check names after CI reuse.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Skip duplicate merge queue smoketest
         run: echo "Merge queue commit has the same tree as the PR head; smoketest already ran for the PR."
@@ -759,7 +761,8 @@ jobs:
   codeowners_check:
     if: ${{ github.event_name == 'pull_request' }}
     name: CODEOWNERS check
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and checks changed paths and GitHub reviews.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
       pull-requests: read
@@ -824,7 +827,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Check that packages are publishable
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and validates package metadata without compiling the workspace.
+    runs-on: spacetimedb-linux-small
     permissions: read-all
     env:
       RUST_BACKTRACE: full
@@ -855,7 +859,8 @@ jobs:
     strategy:
       matrix:
         include:
-          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-linux }
+          # The Linux update-flow test uses released artifacts and builds only its small CI driver.
+          - { target: x86_64-unknown-linux-gnu, runner: spacetimedb-linux-small }
           - { target: aarch64-apple-darwin, runner: macos-latest }
           - { target: x86_64-pc-windows-msvc, runner: windows-latest }
     runs-on: ${{ matrix.runner }}
@@ -905,7 +910,8 @@ jobs:
           - { target: x86_64-unknown-linux-gnu }
           - { target: aarch64-apple-darwin }
           - { target: x86_64-pc-windows-msvc }
-    runs-on: spacetimedb-linux
+    # These no-op jobs only preserve required update-flow check names after CI reuse.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Skip duplicate merge queue update test
         run: echo "Merge queue commit has the same tree as the PR head; update-flow already ran for the PR."
@@ -1266,6 +1272,7 @@ jobs:
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     permissions:
       contents: read
+    # The .NET packaging, Godot project build, and integration test make this too heavy for a small runner.
     runs-on: spacetimedb-linux
     env:
       ARTIFACT_SUFFIX: linux
@@ -1368,6 +1375,7 @@ jobs:
   csharp-testsuite:
     needs: [merge_queue_noop, lints, upload-build-artifacts-linux]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
+    # The C# SDK build and tests saturated the small runner's CPU, so keep this on the main runner.
     runs-on: spacetimedb-linux
     timeout-minutes: 30
     env:
@@ -1485,7 +1493,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Verify global.json files are symlinks
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and checks symlink policy without building SpacetimeDB.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
     env:
@@ -1529,7 +1538,8 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Check smoketests/mod.rs is complete
-    runs-on: spacetimedb-linux
+    # This builds a tiny source-scanning helper and does not compile or run smoketests.
+    runs-on: spacetimedb-linux-small
     permissions:
       contents: read
     env:
@@ -1565,6 +1575,7 @@ jobs:
     needs: [merge_queue_noop]
     if: ${{ needs.merge_queue_noop.outputs.skip != 'true' }}
     name: Docs build
+    # Building the documentation site nearly saturated a small runner and used substantial memory.
     runs-on: spacetimedb-linux
     env:
       RUST_BACKTRACE: full
diff --git a/.github/workflows/cla-gate.yml b/.github/workflows/cla-gate.yml
index c64f583da64..40c2864f219 100644
--- a/.github/workflows/cla-gate.yml
+++ b/.github/workflows/cla-gate.yml
@@ -17,7 +17,8 @@ permissions:
 jobs:
   publish-cla-gate-status:
     name: CLA status
-    runs-on: spacetimedb-linux
+    # This only evaluates GitHub status metadata and publishes a commit status.
+    runs-on: spacetimedb-linux-small
     if: github.event_name != 'status' || github.event.context == 'license/cla'
 
     steps:
diff --git a/.github/workflows/discord-posts.yml b/.github/workflows/discord-posts.yml
index ee43d68df50..42513554af3 100644
--- a/.github/workflows/discord-posts.yml
+++ b/.github/workflows/discord-posts.yml
@@ -11,7 +11,8 @@ permissions:
 
 jobs:
   resolvePush:
-    runs-on: spacetimedb-linux
+    # This only resolves GitHub event metadata and performs no checkout or build.
+    runs-on: spacetimedb-linux-small
     outputs:
       is_pr_merge: ${{ steps.resolve.outputs.is_pr_merge }}
       is_external: ${{ steps.resolve.outputs.is_external }}
@@ -80,7 +81,8 @@ jobs:
 
   discordNotification:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only queries pull-request checks and posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge == 'true'
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -157,7 +159,8 @@ jobs:
     needs:
       - resolvePush
       - discordNotification
-    runs-on: spacetimedb-linux
+    # This failure path only posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: ${{ always() && (needs.resolvePush.result == 'failure' || needs.discordNotification.result == 'failure') }}
     steps:
       - name: Send failure notification
@@ -172,7 +175,8 @@ jobs:
 
   warnDirectPush:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only formats commit metadata and posts a Discord warning.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge != 'true'
     steps:
       - name: Warn about non-PR push
@@ -197,7 +201,8 @@ jobs:
 
   invokePrivate:
     needs: resolvePush
-    runs-on: spacetimedb-linux
+    # This only dispatches the private workflow through the GitHub API.
+    runs-on: spacetimedb-linux-small
     if: needs.resolvePush.outputs.is_pr_merge == 'true'
     permissions:
       contents: read
diff --git a/.github/workflows/docs-publish.yaml b/.github/workflows/docs-publish.yaml
index bde3900dca8..9eff7a1bfda 100644
--- a/.github/workflows/docs-publish.yaml
+++ b/.github/workflows/docs-publish.yaml
@@ -10,7 +10,8 @@ on:
 
 jobs:
   build:
-    runs-on: spacetimedb-linux
+    # This builds and uploads the documentation site, not SpacetimeDB binaries.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
diff --git a/.github/workflows/docs-update-llms.yaml b/.github/workflows/docs-update-llms.yaml
index 741d91a0fe9..b1f5525b368 100644
--- a/.github/workflows/docs-update-llms.yaml
+++ b/.github/workflows/docs-update-llms.yaml
@@ -14,7 +14,8 @@ on:
 
 jobs:
   update-llms:
-    runs-on: spacetimedb-linux
+    # This builds documentation assets and updates one generated text file.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
diff --git a/.github/workflows/internal-tests.yml b/.github/workflows/internal-tests.yml
index 3d429a1b8b5..6a2d47509d7 100644
--- a/.github/workflows/internal-tests.yml
+++ b/.github/workflows/internal-tests.yml
@@ -27,7 +27,8 @@ jobs:
     # Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
     if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))
       && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
-    runs-on: spacetimedb-linux
+    # This builds small workflow helpers, dispatches private CI, and waits for its result.
+    runs-on: spacetimedb-linux-small
     env:
       TARGET_OWNER: clockworklabs
       TARGET_REPO: SpacetimeDBPrivate
diff --git a/.github/workflows/llm-benchmark-periodic.yml b/.github/workflows/llm-benchmark-periodic.yml
index eaa66490510..9230922b449 100644
--- a/.github/workflows/llm-benchmark-periodic.yml
+++ b/.github/workflows/llm-benchmark-periodic.yml
@@ -50,7 +50,8 @@ concurrency:
 jobs:
   prepare_matrix:
     name: Prepare benchmark matrix
-    runs-on: spacetimedb-linux
+    # This only parses workflow inputs into a JSON matrix and performs no benchmark work.
+    runs-on: spacetimedb-linux-small
     outputs:
       languages: ${{ steps.matrix.outputs.languages }}
     steps:
diff --git a/.github/workflows/pr_approval_check.yml b/.github/workflows/pr_approval_check.yml
index 25d4d1f6745..1c68feb6fa1 100644
--- a/.github/workflows/pr_approval_check.yml
+++ b/.github/workflows/pr_approval_check.yml
@@ -29,7 +29,8 @@ concurrency:
 jobs:
   publish-approval-status:
     name: Set approval status
-    runs-on: spacetimedb-linux
+    # This disabled metadata-only job performs no checkout or build when re-enabled.
+    runs-on: spacetimedb-linux-small
     # Disabled until we can spend some more focus on making this work consistently.
     # See https://github.com/clockworklabs/SpacetimeDB/pull/4673.
     if: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa36f0bc8f2..a36348b6bb7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,7 +60,8 @@ concurrency:
 jobs:
   validate-release-invoker:
     name: Validate release invoker
-    runs-on: spacetimedb-linux
+    # This only validates workflow inputs and the invoking actor.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Reject direct public release invocations
         env:
@@ -109,7 +110,8 @@ jobs:
 
   release-crates:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This packages and publishes crates with the prebuilt release helper; it does not build the workspace.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_crates }}
     env:
       CARGO_TERM_COLOR: always
@@ -230,7 +232,8 @@ jobs:
 
   release-cpp:
     needs: build-cargo-release
-    runs-on: spacetimedb-linux
+    # This updates and publishes the generated C++ SDK repository without a core build.
+    runs-on: spacetimedb-linux-small
     if: ${{ inputs.release_cpp }}
     env:
       CARGO_TERM_COLOR: always
@@ -424,7 +427,8 @@ jobs:
       - release-npm
       - release-docker
       - update-mirror-latest-version
-    runs-on: spacetimedb-linux
+    # This only publishes existing artifacts and dispatches the release announcement.
+    runs-on: spacetimedb-linux-small
     if: >-
       ${{
         always()
diff --git a/.github/workflows/retry-cla-assistant.yml b/.github/workflows/retry-cla-assistant.yml
index 929fbc79125..f84949efd03 100644
--- a/.github/workflows/retry-cla-assistant.yml
+++ b/.github/workflows/retry-cla-assistant.yml
@@ -31,7 +31,8 @@ permissions:
 jobs:
   retry-cla:
     name: Retry CLA Assistant if it is the only blocker
-    runs-on: spacetimedb-linux
+    # This builds a small CI helper and only queries or retries CLA checks.
+    runs-on: spacetimedb-linux-small
 
     steps:
       - name: Check out trusted base code
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index d2e3fbc57f4..1bf6fc14d8f 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -30,7 +30,8 @@ jobs:
   # Internal/team announcement (simple)
   announce-release:
     name: Announce GitHub release (Internal)
-    runs-on: spacetimedb-linux
+    # This only formats release metadata and posts a Discord notification.
+    runs-on: spacetimedb-linux-small
     if: >-
       ${{
         github.event_name == 'release'
@@ -52,7 +53,8 @@ jobs:
   # Public announcement with full release notes
   public-discord-notification:
     name: Announce GitHub release (Public)
-    runs-on: spacetimedb-linux
+    # This only formats release notes and posts them to Discord.
+    runs-on: spacetimedb-linux-small
     steps:
       - name: Send Discord notification
         env: