diff --git a/.github/workflows/diff-pr.yml b/.github/workflows/diff-pr.yml
index 7ba4bd7..e20624a 100644
--- a/.github/workflows/diff-pr.yml
+++ b/.github/workflows/diff-pr.yml
@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   dix:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/diff-tag.yml b/.github/workflows/diff-tag.yml
index 8224366..6e6e778 100644
--- a/.github/workflows/diff-tag.yml
+++ b/.github/workflows/diff-tag.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   dix:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index 452cfe6..220af69 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   flake-check:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index 2e57a9e..700c672 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 89a6d6f..9dfacbc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/vulnix.yml b/.github/workflows/vulnix.yml
index aa7e347..85fa661 100644
--- a/.github/workflows/vulnix.yml
+++ b/.github/workflows/vulnix.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
+    runs-on: nix
     steps:
       - uses: actions/checkout@v4
 
diff --git a/containers/server-n0/git.nix b/containers/server-n0/git.nix
index f4510d7..41a5e74 100644
--- a/containers/server-n0/git.nix
+++ b/containers/server-n0/git.nix
@@ -8,6 +8,9 @@ let
   inherit (dsl) mkContainer mkVm;
   inherit (hostInfo.paths) data secrets;
 
+  pubSshPort = 23;
+  intSshPort = 23 + 8000;
+
   ciRunnerData = "${data}/web/git-ci-runner";
   ciRunnerSecrets = "${secrets}/ci-runner";
 in
@@ -17,8 +20,8 @@ in
     net.access = [ { to = "@internet"; } ];
     net.forward.tcp = [
       {
-        host = 23;
-        container = 8023;
+        host = pubSshPort;
+        container = intSshPort;
       }
     ];
     svc.autoStart = true;
@@ -38,7 +41,8 @@ in
             ROOT_URL = "https://git.floweytf.com/";
             START_SSH_SERVER = true;
             BUILTIN_SSH_SERVER_USER = "git";
-            SSH_PORT = 8023;
+            SSH_PORT = pubSshPort;
+            SSH_LISTEN_PORT = intSshPort;
           };
           service.DISABLE_REGISTRATION = true;
         };