diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 743448b13..997776b03 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -18,8 +18,9 @@ jobs:
     #   github.event.pull_request.user.login == 'new-developer' ||
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
-    # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable.
-    runs-on: ubuntu-latest
+    # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+    # When public, use GitHub-hosted runners by default.
+    runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }}
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..ea30ee464
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,45 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+    # When public, use GitHub-hosted runners by default.
+    runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [csharp, javascript-typescript, python]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        if: matrix.language == 'csharp'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/review-intelligencex.yml b/.github/workflows/review-intelligencex.yml
index b76b186a1..31e9458c0 100644
--- a/.github/workflows/review-intelligencex.yml
+++ b/.github/workflows/review-intelligencex.yml
@@ -17,8 +17,9 @@ on:
 jobs:
   # INTELLIGENCEX:BEGIN
   review:
-    # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable.
-    runs-on: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || '["self-hosted","ubuntu"]') }}
+    # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+    # When public, use GitHub-hosted runners by default.
+    runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }}
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/test-dotnet.yml b/.github/workflows/test-dotnet.yml
index 90a4feeac..4e31ced35 100644
--- a/.github/workflows/test-dotnet.yml
+++ b/.github/workflows/test-dotnet.yml
@@ -21,8 +21,8 @@ env:
 jobs:
     test-windows:
         name: 'Windows'
-        # Use self-hosted runners for private repos (avoid GitHub-hosted costs).
-        # When the repo becomes public, switch to GitHub-hosted runners automatically.
+        # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+        # When public, use GitHub-hosted runners by default.
         runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","windows"]' || '["windows-latest"]') }}
         timeout-minutes: 20
         steps:
@@ -74,8 +74,9 @@ jobs:
 
     test-ubuntu:
         name: 'Ubuntu'
-        # Prefer GitHub-hosted runners for PR checks to avoid blocking when self-hosted runners are unavailable.
-        runs-on: ${{ fromJSON(github.event_name == 'pull_request' && '["ubuntu-latest"]' || (github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]')) }}
+        # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+        # When public, use GitHub-hosted runners by default.
+        runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","ubuntu"]' || '["ubuntu-latest"]') }}
         timeout-minutes: 20
         steps:
             - name: Checkout code
@@ -119,6 +120,8 @@ jobs:
 
     test-macos:
         name: 'macOS'
+        # While the repo is private, prefer self-hosted runners to avoid GitHub-hosted spend limits.
+        # When public, use GitHub-hosted runners by default.
         runs-on: ${{ fromJSON(github.event.repository.private && '["self-hosted","macos"]' || '["macos-latest"]') }}
         timeout-minutes: 20
         steps: