diff --git a/.github/workflows/malware-scan.yml b/.github/workflows/malware-scan.yml
index 751118839..15ca4faeb 100644
--- a/.github/workflows/malware-scan.yml
+++ b/.github/workflows/malware-scan.yml
@@ -35,7 +35,7 @@ jobs:
     # Plain `self-hosted` — GitHub applies this label to every self-hosted
     # runner automatically. The scan is host-agnostic, unlike the deploy jobs
     # which pin to a branch-specific runner.
-    runs-on: self-hosted
+    runs-on: [self-hosted, dev]
     outputs:
       infected: ${{ steps.scan.outputs.infected }}
     steps: