diff --git a/.github/workflows/nightly-release-green.yml b/.github/workflows/nightly-release-green.yml
index 646c741811..81c599a7a9 100644
--- a/.github/workflows/nightly-release-green.yml
+++ b/.github/workflows/nightly-release-green.yml
@@ -37,7 +37,11 @@ env:
 jobs:
   release-green:
     name: Validate active release branch
-    runs-on: ubuntu-latest
+    # Dynamic runner: with USE_VPS_RUNNER=true (release window / on-demand pre-flight)
+    # this runs on the dedicated VPS runner — clean env (no operator OMNIROUTE_API_KEY,
+    # no local noauth CLIs => zero machine-specific false positives) and no contention.
+    # Nightly cron normally finds the var false (VM off) and falls back to hosted.
+    runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && fromJSON('["self-hosted","omni-release"]')) || 'ubuntu-latest' }}
     env:
       JWT_SECRET: ci-nightly-secret-with-sufficient-length-for-validation
       API_KEY_SECRET: ci-nightly-api-key-secret-long
@@ -91,7 +95,9 @@ jobs:
         id: validate
         run: |
           set +e
-          node scripts/quality/validate-release-green.mjs --json --with-build \
+          # --hermetic: scrub live-test trigger vars (self-hosted runner may carry
+          # operator env; hosted ignores the unknown flag before #6300 lands).
+          node scripts/quality/validate-release-green.mjs --json --with-build --hermetic \
             1> release-green.json 2> release-green.log
           echo "exit=$?" >> "$GITHUB_OUTPUT"
           echo "------- report -------"