diff --git a/.gitea/workflows/handlers-postgres-integration.yml b/.gitea/workflows/handlers-postgres-integration.yml
index f88761bbe..825b34d88 100644
--- a/.gitea/workflows/handlers-postgres-integration.yml
+++ b/.gitea/workflows/handlers-postgres-integration.yml
@@ -77,16 +77,12 @@ env:
 jobs:
   detect-changes:
     name: detect-changes
-    # mc#1529 §1: pin to `docker-host` so the integration job runs on the
-    # operator-host runners (molecule-runner-*), which carry the
-    # `molecule-core-net` bridge network this workflow depends on. PC2
-    # runners (hongming-pc-runner-*) also advertise ubuntu-latest but
-    # don't have that network — the previous `runs-on: ubuntu-latest`
-    # rolled the dice and hard-failed the bridge-inspect step ~30% of
-    # the time. detect-changes itself doesn't need the bridge, but keeping
-    # both jobs on the same label avoids workspace-volume cross-host
-    # surprises and keeps the routing rule discoverable in one place.
-    runs-on: docker-host
+    # mc#1529 §1 + internal#797: pin to `docker-host` runners that ALSO
+    # advertise the `molecule-core-net` label. This bridges the gap where
+    # some `docker-host` runners were provisioned without the network.
+    # The array means the runner must satisfy BOTH labels (Gitea Actions
+    # label-AND semantics). See status-reaper.yml for the same pattern.
+    runs-on: [docker-host, molecule-core-net]
     # mc#1982 Phase 3 (RFC §1): surface broken workflows without blocking.
     # mc#1982: mask removed. If regressions appear, root-fix the underlying
     # test — do NOT renew the mask silently.
@@ -116,9 +112,10 @@ jobs:
   integration:
     name: Handlers Postgres Integration
     needs: detect-changes
-    # mc#1529 §1: must run on operator-host (where `molecule-core-net`
-    # exists). See detect-changes for the full routing rationale.
-    runs-on: docker-host
+    # mc#1529 §1 + internal#797: must run on operator-host where
+    # `molecule-core-net` exists. See detect-changes for the full
+    # routing rationale.
+    runs-on: [docker-host, molecule-core-net]
     # mc#1982 Phase 3 (RFC §1): surface broken workflows without blocking.
     # mc#1982: mask removed. If regressions appear, root-fix the underlying
     # test — do NOT renew the mask silently.