diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 6206264783..33e6c6ae12 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -10,7 +10,7 @@ on:
 jobs:
   backport:
     if: github.event.pull_request.merged
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     container: hashicorpdev/backport-assistant:0.2.3
     steps:
       - name: Backport changes to stable-website
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 53518c686b..e8fcb22952 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -7,7 +7,7 @@ on:
 jobs:
   CodeQL-Build:
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
 
     steps:
     - name: Checkout repository
diff --git a/.github/workflows/enos-ci-bootstrap-oss.yml b/.github/workflows/enos-ci-bootstrap-oss.yml
index 26f42db009..105986c3d5 100644
--- a/.github/workflows/enos-ci-bootstrap-oss.yml
+++ b/.github/workflows/enos-ci-bootstrap-oss.yml
@@ -22,7 +22,7 @@ jobs:
       TF_VAR_repository: boundary
       TF_VAR_aws_ssh_public_key: ${{ secrets.SSH_KEY_PUBLIC_CI }}
       TF_TOKEN_app_terraform_io: ${{ secrets.TF_API_TOKEN }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
       - uses: actions/checkout@v3
       - name: Set up Terraform
diff --git a/.github/workflows/enos-fmt.yml b/.github/workflows/enos-fmt.yml
index 3923992d12..e4bbfa9e0c 100644
--- a/.github/workflows/enos-fmt.yml
+++ b/.github/workflows/enos-fmt.yml
@@ -11,7 +11,7 @@ jobs:
     # Only run this workflow on pull requests from hashicorp/boundary branches
     # as we need secrets to install enos.
     if: "! github.event.pull_request.head.repo.fork"
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     env:
       GITHUB_TOKEN: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
     steps:
diff --git a/.github/workflows/enos-run.yml b/.github/workflows/enos-run.yml
index 88b5955ca3..35e5b6dc96 100644
--- a/.github/workflows/enos-run.yml
+++ b/.github/workflows/enos-run.yml
@@ -29,7 +29,7 @@ jobs:
           - filter: 'e2e_database'
           - filter: 'e2e_static builder:crt'
           - filter: 'e2e_static_with_vault builder:crt'
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     env:
       GITHUB_TOKEN: ${{ secrets.SERVICE_USER_GITHUB_TOKEN }}
     outputs:
@@ -201,7 +201,7 @@ jobs:
   notify:
     name: Notify
     needs: enos
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     if: ${{ always() && needs.enos.outputs.status == 'failure' }}
     steps:
       - name: Send Slack message
diff --git a/.github/workflows/jira.yml b/.github/workflows/jira.yml
index 5e064d32d6..e539c0d5d3 100644
--- a/.github/workflows/jira.yml
+++ b/.github/workflows/jira.yml
@@ -11,7 +11,7 @@ name: Jira Sync
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     name: Jira sync
     steps:
     - name: Check if community user
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 23956a02fb..5065472feb 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -4,7 +4,7 @@ on:
 
 jobs:
   triage:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
     - uses: actions/labeler@main
       with:
diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml
index a2ef6e7ccf..4a2ad3e31c 100644
--- a/.github/workflows/linting.yml
+++ b/.github/workflows/linting.yml
@@ -4,7 +4,7 @@ on: ["pull_request"]
 jobs:
   lint:
     name: "Run Linter"
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/milestone-checker.yml b/.github/workflows/milestone-checker.yml
index 7cef8ccfee..369d120369 100644
--- a/.github/workflows/milestone-checker.yml
+++ b/.github/workflows/milestone-checker.yml
@@ -16,7 +16,7 @@ jobs:
   milestone-check:
     # If there is a `pr/no-milestone` label we ignore this check
     if: "!contains(github.event.pull_request.labels.*.name, 'pr/no-milestone')"
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     steps:
       - name: Checkout Actions
         uses: actions/checkout@v3
diff --git a/.github/workflows/test-ci-cleanup-oss.yml b/.github/workflows/test-ci-cleanup-oss.yml
index ddb19c13db..e283b406f2 100644
--- a/.github/workflows/test-ci-cleanup-oss.yml
+++ b/.github/workflows/test-ci-cleanup-oss.yml
@@ -7,7 +7,7 @@ on:
 jobs:
   setup:
     if: ${{ github.event.repository.name == 'boundary' }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     outputs:
       regions: ${{steps.setup.outputs.regions}}
     steps:
@@ -33,7 +33,7 @@ jobs:
   aws-nuke:
     if: ${{ github.event.repository.name == 'boundary' }}
     needs: setup
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     container:
       image: rebuy/aws-nuke
       options:
@@ -71,7 +71,7 @@ jobs:
   check-quotas:
     if: ${{ github.event.repository.name == 'boundary' }}
     needs: [ setup, aws-nuke ]
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RUNNER) }}
     container:
       image: jantman/awslimitchecker
       env: