diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 3d0104c..8d0f600 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -8,6 +8,7 @@ self-hosted-runner:
     - linux-arm64-xl
     - self-hosted-arm64
     - self-hosted-arm64-2xl
+    - arc-arm64-1cpu-2gb-nodocker
     - arc-arm64-2cpu-4gb
     - arc-arm64-4cpu-12gb
     - arc-arm64-8cpu-24gb
diff --git a/.github/workflows/allow-deploys.yml b/.github/workflows/allow-deploys.yml
index 8dc8f07..88586d7 100644
--- a/.github/workflows/allow-deploys.yml
+++ b/.github/workflows/allow-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   allow-release:
     name: Allow release
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/block-deploys.yml b/.github/workflows/block-deploys.yml
index a698c81..e1adf6f 100644
--- a/.github/workflows/block-deploys.yml
+++ b/.github/workflows/block-deploys.yml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   disable-deploy-flows:
     name: Disable and cancel deploy
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/component-build.yml b/.github/workflows/component-build.yml
index c7b9174..7cd72b5 100644
--- a/.github/workflows/component-build.yml
+++ b/.github/workflows/component-build.yml
@@ -99,7 +99,7 @@ permissions:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner: ${{ steps.runner.outputs.runner-name }}
diff --git a/.github/workflows/component-deploy-v2.yml b/.github/workflows/component-deploy-v2.yml
index 352c48d..c61aa98 100644
--- a/.github/workflows/component-deploy-v2.yml
+++ b/.github/workflows/component-deploy-v2.yml
@@ -84,7 +84,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/component-deploy.yml b/.github/workflows/component-deploy.yml
index a4f965f..d48e3d9 100644
--- a/.github/workflows/component-deploy.yml
+++ b/.github/workflows/component-deploy.yml
@@ -72,7 +72,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 20
     outputs:
       stage: ${{ inputs.stage }}
diff --git a/.github/workflows/component-test-kotlin.yml b/.github/workflows/component-test-kotlin.yml
index d6b8b25..10f6a17 100644
--- a/.github/workflows/component-test-kotlin.yml
+++ b/.github/workflows/component-test-kotlin.yml
@@ -51,7 +51,7 @@ env:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ inputs.use-arc-runners && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ inputs.use-arc-runners && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
     steps:
diff --git a/.github/workflows/component-test-python.yml b/.github/workflows/component-test-python.yml
index 6d964c4..7316293 100644
--- a/.github/workflows/component-test-python.yml
+++ b/.github/workflows/component-test-python.yml
@@ -50,7 +50,7 @@ permissions:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
     steps:
diff --git a/.github/workflows/create-release-tag.yml b/.github/workflows/create-release-tag.yml
index 51a08b6..dac5ad9 100644
--- a/.github/workflows/create-release-tag.yml
+++ b/.github/workflows/create-release-tag.yml
@@ -12,7 +12,7 @@ on:
 jobs:
   create-tag:
     name: Create Release Tag
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/deploy-generic-v2.yml b/.github/workflows/deploy-generic-v2.yml
index fb47c14..b67c05d 100644
--- a/.github/workflows/deploy-generic-v2.yml
+++ b/.github/workflows/deploy-generic-v2.yml
@@ -149,7 +149,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-generic.yml b/.github/workflows/deploy-generic.yml
index 0d23b61..bb81e67 100644
--- a/.github/workflows/deploy-generic.yml
+++ b/.github/workflows/deploy-generic.yml
@@ -140,7 +140,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/deploy-kotlin-v2.yml b/.github/workflows/deploy-kotlin-v2.yml
index 657cf22..8819633 100644
--- a/.github/workflows/deploy-kotlin-v2.yml
+++ b/.github/workflows/deploy-kotlin-v2.yml
@@ -328,7 +328,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-kotlin.yml b/.github/workflows/deploy-kotlin.yml
index ee71c18..47a3e06 100644
--- a/.github/workflows/deploy-kotlin.yml
+++ b/.github/workflows/deploy-kotlin.yml
@@ -313,7 +313,7 @@ jobs:
     name: Create and Publish Changelog
     needs: [create-release-tag, deploy]
     if: always() && inputs.enable-changelog && needs.deploy.result == 'success'
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Run changelog cli action
diff --git a/.github/workflows/deploy-python.yml b/.github/workflows/deploy-python.yml
index 7eccc29..4e88c4b 100644
--- a/.github/workflows/deploy-python.yml
+++ b/.github/workflows/deploy-python.yml
@@ -100,7 +100,7 @@ permissions:
 jobs:
   slack-token-deprecation:
     name: Deprecation check
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Warn if deprecated SLACK_APP_TOKEN is provided
         env:
diff --git a/.github/workflows/pr-digest.yml b/.github/workflows/pr-digest.yml
index 6a94422..e3493ea 100644
--- a/.github/workflows/pr-digest.yml
+++ b/.github/workflows/pr-digest.yml
@@ -69,7 +69,7 @@ permissions:
 jobs:
   digest:
     name: Build and post PR digest
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/pull-request-bun.yml b/.github/workflows/pull-request-bun.yml
index 01f8c02..49df08c 100644
--- a/.github/workflows/pull-request-bun.yml
+++ b/.github/workflows/pull-request-bun.yml
@@ -57,7 +57,7 @@ on:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
diff --git a/.github/workflows/pull-request-kotlin.yml b/.github/workflows/pull-request-kotlin.yml
index b25e8c0..82d91c8 100644
--- a/.github/workflows/pull-request-kotlin.yml
+++ b/.github/workflows/pull-request-kotlin.yml
@@ -98,7 +98,7 @@ env:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
@@ -115,7 +115,7 @@ jobs:
           use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
   check-migration-order:
     name: Check Migration Order
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     timeout-minutes: 5
     steps:
       - name: Checkout
diff --git a/.github/workflows/pull-request-react.yml b/.github/workflows/pull-request-react.yml
index 0ede8b1..b048b14 100644
--- a/.github/workflows/pull-request-react.yml
+++ b/.github/workflows/pull-request-react.yml
@@ -63,7 +63,7 @@ on:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     timeout-minutes: 5
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
diff --git a/.github/workflows/rollback.yml b/.github/workflows/rollback.yml
index 4917c7b..a0bc136 100644
--- a/.github/workflows/rollback.yml
+++ b/.github/workflows/rollback.yml
@@ -79,7 +79,7 @@ jobs:
     needs: block-deploys
     if: ${{ !cancelled() && (needs.block-deploys.result == 'success' || needs.block-deploys.result == 'skipped') }}
     name: Deploy rollback
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
diff --git a/.github/workflows/sonar-cloud.yml b/.github/workflows/sonar-cloud.yml
index fd8caa1..ef15e85 100644
--- a/.github/workflows/sonar-cloud.yml
+++ b/.github/workflows/sonar-cloud.yml
@@ -63,7 +63,7 @@ env:
 jobs:
   setup:
     name: Setup
-    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-2cpu-4gb' || 'linux-arm64' }}
+    runs-on: ${{ (inputs.use-arc-runners && github.event.repository.private) && 'arc-arm64-1cpu-2gb-nodocker' || 'linux-arm64' }}
     outputs:
       runner-name: ${{ steps.runner.outputs.runner-name }}
     steps:
diff --git a/.github/workflows/track-pending-release.yml b/.github/workflows/track-pending-release.yml
index 38e4e64..2a5c233 100644
--- a/.github/workflows/track-pending-release.yml
+++ b/.github/workflows/track-pending-release.yml
@@ -17,7 +17,7 @@ on:
 jobs:
   update-pending-release:
     name: Update Pending Release Changelog
-    runs-on: ${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}
+    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
     timeout-minutes: 5
     steps:
       - name: Checkout
diff --git a/CLAUDE.md b/CLAUDE.md
index 3fa88b1..7cc8b08 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3,9 +3,10 @@
 ## Last Documentation Update
 - **Date**: 2026-10-06
 - **Latest SHA**: 340af8f (check for newer commits)
-- **Changes**: The shared workflows' own jobs run on ARC in private repositories
+- **Changes**: Small shared-workflow jobs run on the Docker-less ARC runner
 
 ## Recent Changes (2026-10-06)
+1. **Small jobs on `arc-arm64-1cpu-2gb-nodocker`**: the shared workflows' small jobs that need no Docker moved there from `arc-arm64-2cpu-4gb` (kube-manifests#7784 added the set: 0.5 CPU guaranteed, 2 GiB, no dind, ~14 per node): the Setup/converter jobs (`component-build`, `component-test-kotlin`, `component-test-python`, `pull-request-{bun,kotlin,react}`, `sonar-cloud`), `check-migration-order`, the `component-deploy(-v2)` deploy job, `create-release-tag`, the changelog and Slack-token deprecation jobs, `track-pending-release`, `pr-digest`, `allow-/block-deploys` and rollback's `push-manifest`. Jobs that need Docker stay on `arc-arm64-2cpu-4gb`: rollback's `slackNotification` (`rtCamp/action-slack-notify` runs a `docker://` image), this repo's `lint-workflows` (`reviewdog/action-actionlint` is a Docker action), and `publish-tech-docs` (a docs build). Anything added to these jobs must not use `container:`, `services:` or a Docker-based action.
 1. **The shared workflows' own jobs run on ARC**: the 17 jobs that named a GitHub-hosted label (`component-deploy(-v2)` deploy, `create-release-tag`, the deploy workflows' changelog and Slack-token deprecation jobs, `rollback`, `track-pending-release`, `pr-digest`, `publish-tech-docs`, `allow-/block-deploys`, `semgrep-security-scan`, and this repo's own `pull-request.yml`) use `${{ github.event.repository.private && 'arc-arm64-2cpu-4gb' || 'ubuntu-24.04-arm' }}`; semgrep gets `arc-arm64-4cpu-12gb`. Public callers, and events without a repository in the payload (`schedule`), get GitHub's standard arm64 runner. The deploy and rollback jobs rely on `yq` v4 and `jq` from the runner, both in the ARC image; `argocd` is downloaded by `argocd-wait-sync`, and nothing calls the `helm` CLI.
 
 ## Recent Changes (2026-10-05)