diff --git a/k8s/applications/portainer/portainer-values.yaml b/k8s/applications/portainer/portainer-values.yaml
index 4374f05..3711dc1 100644
--- a/k8s/applications/portainer/portainer-values.yaml
+++ b/k8s/applications/portainer/portainer-values.yaml
@@ -51,3 +51,8 @@ tolerations:
   - key: node-role.kubernetes.io/control-plane
     operator: Exists
     effect: NoSchedule
+
+# Pin to az-a (talos-cp-1) — sole Longhorn storage node. Its RWO PVC can only
+# attach there; without this the pod may land on cp-2/cp-3 and fail to mount.
+nodeSelector:
+  topology.kubernetes.io/zone: az-a
diff --git a/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml b/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
index a87a725..49394ce 100644
--- a/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
+++ b/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml
@@ -19,6 +19,10 @@ spec:
     spec:
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 
       initContainers:
         - name: register
diff --git a/k8s/security/ci-cd/charts/forgejo-runner/values.yaml b/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
index 818d054..74c9832 100644
--- a/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
+++ b/k8s/security/ci-cd/charts/forgejo-runner/values.yaml
@@ -40,3 +40,8 @@ tolerations:
   - key: node-role.kubernetes.io/control-plane
     operator: Exists
     effect: NoSchedule
+
+# Pin to az-a (talos-cp-1) — sole Longhorn node; RWO PVCs (reg/dind cache) only
+# attach there.
+nodeSelector:
+  topology.kubernetes.io/zone: az-a