diff --git a/.github/workflows/semgrep-package-managers.yml b/.github/workflows/semgrep-package-managers.yml
index 5e4bd32..095c2fa 100644
--- a/.github/workflows/semgrep-package-managers.yml
+++ b/.github/workflows/semgrep-package-managers.yml
@@ -13,11 +13,10 @@ env:
 jobs:
     # scans the entire repo for package managers missing a minimum release age / cooldown
     semgrep-package-managers:
-        # This workflow runs org-wide as a required workflow. Private/internal repos
-        # get the faster Depot runner; public repos stay on GitHub-hosted ubuntu-latest
-        # (free minutes, and not every public repo has Depot enabled). The repository
-        # context reflects the target repo, so this resolves per-repo automatically.
-        runs-on: ${{ github.event.repository.private && 'depot-ubuntu-latest' || 'ubuntu-latest' }}
+        # This workflow runs org-wide as a required workflow. It uses the Depot runner
+        # everywhere. The shared GitHub-hosted ubuntu-latest pool queues this required
+        # check for longer than it runs, so public repos no longer stay on that pool.
+        runs-on: depot-ubuntu-latest
         timeout-minutes: 15
         container:
             image: semgrep/semgrep:1.163.0@sha256:7cad2bc2d1e44f87f0bf4be6d1fa23aa90fb72015bebc89fb91385d813987a03