diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2e70cab6f..dd60593a85 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,9 +76,14 @@ jobs:
           compression-level: 0
 
   node-24-coverage:
-    if: github.event_name == 'pull_request'
-    # Coverage does not gate merges, so it runs on the in-house pool
-    # (self-hosted, 64-core) instead of the metered enterprise pool.
+    # Same-repo PRs only: this lane runs on an in-house self-hosted runner,
+    # so fork-originated code must never land here. The repo is currently
+    # private with forking disabled; this guard keeps that invariant explicit
+    # if either setting ever changes.
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+    # Runs on the in-house pool (self-hosted, 64-core) instead of the metered
+    # enterprise pool. The pool holds 4 always-on instances plus 4 registered
+    # spares; the runner service is systemd-managed and self-healing.
     runs-on: [self-hosted, linux, x64, vm-backup]
     name: node 24 / coverage
     env:
@@ -91,8 +96,12 @@ jobs:
 
       - uses: actions/cache/restore@v4
         with:
-          # ~ resolves on both hosted (/home/runner) and self-hosted homes
-          path: ~/.local/share/pnpm/store/v11
+          # Path must stay byte-identical to the save-side path in the master
+          # lane: actions/cache hashes the literal path into the cache version,
+          # so any variation (e.g. ~) would never match the saved cache. On
+          # self-hosted this restore simply misses and the persistent local
+          # pnpm store covers warm installs instead.
+          path: /home/runner/.local/share/pnpm/store/v11
           key: ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-node-${{ env.PRIMARY_NODE_VERSION }}-pnpm-