diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index 814a192..3b8aa96 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -46,11 +46,12 @@ permissions:
 
 jobs:
   triage:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10   # Hypatia workflow_audit/missing_timeout_minutes (alert #68)
     steps:
       - name: Classify and label
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           NUM: ${{ github.event.issue.number || inputs.issue }}
         run: |
           set -uo pipefail
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 83ab941..c496ffd 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -32,11 +32,12 @@ permissions:
 
 jobs:
   sync:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10   # Hypatia workflow_audit/missing_timeout_minutes (alert #69)
     steps:
       - name: Apply canonical labels
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           # ⚠ LOAD-BEARING. This workflow deliberately does not check the repo
           # out (no `uses:`, so no actions.lock entry can drift), which means
           # `gh label create` / `gh label edit` have no git remote to infer a