diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index a50d31f0d..509eea8e4 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -184,8 +184,9 @@ COPY --chown=vscode:vscode apps/frontend/package.json apps/frontend/package-lock
 RUN . /usr/local/share/nvm/nvm.sh && (npm ci --legacy-peer-deps --ignore-scripts || npm install --legacy-peer-deps --ignore-scripts || true)
 
 # Install Playwright browsers (baked into image for faster test execution)
-# This prevents the need to run 'npx playwright install' every time tests run
-RUN . /usr/local/share/nvm/nvm.sh && npx playwright install chromium
+# Allow failure under QEMU (multi-platform build): arm64/amd64 cross-build can fail;
+# system chromium is already installed via apt above; browsers can be installed at container start if needed
+RUN . /usr/local/share/nvm/nvm.sh && npx playwright install chromium || true
 
 # Clean up temp directories
 USER root
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 980af85cd..96405fd0a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -18,7 +18,8 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL Analysis
-    runs-on: k3s-simpleaccounts-runners
+    # CodeQL does not support linux/arm64; use GitHub-hosted x64 runner
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     # Skip fork PRs: CodeQL upload requires elevated permissions not granted to forks.
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
@@ -69,7 +70,7 @@ jobs:
 
   dependency-review:
     name: Dependency Review
-    runs-on: k3s-simpleaccounts-runners
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event_name == 'pull_request'
     permissions: