diff --git a/.gitea/workflows/codegen.yml b/.gitea/workflows/codegen.yml
index d9b0f60..b238c5b 100644
--- a/.gitea/workflows/codegen.yml
+++ b/.gitea/workflows/codegen.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   deterministic:
     runs-on: ubuntu-latest
+    env:
+      CARGO_BUILD_JOBS: "1"
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -40,7 +42,7 @@ jobs:
           cargo test -p libremetaverse --lib joint_get_aliases_list
       - name: Build and audit clean Rust-only release artifacts
         run: |
-          cargo build --workspace --release --locked
+          cargo build -p libremetaverse-codegen --release --locked -j 1
           python3 tools/check_codegen_gate.py --release-dir target/release
       - name: Lint native generator
         run: |
diff --git a/.gitea/workflows/jpeg2000.yml b/.gitea/workflows/jpeg2000.yml
index 481ca72..d4abec6 100644
--- a/.gitea/workflows/jpeg2000.yml
+++ b/.gitea/workflows/jpeg2000.yml
@@ -7,6 +7,11 @@ on:
 jobs:
   linux:
     runs-on: ubuntu-latest
+    env:
+      # Ubuntu 24.04 also ships an older libopenjp2.so.7. Ensure both
+      # pkg-config and the runtime loader select the audited 2.5.4 install.
+      PKG_CONFIG_PATH: /usr/local/lib/pkgconfig
+      LD_LIBRARY_PATH: /usr/local/lib
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -19,6 +24,7 @@ jobs:
           cmake --build /tmp/openjpeg-build --parallel
           sudo cmake --install /tmp/openjpeg-build
           sudo ldconfig
+          test "$(pkg-config --modversion libopenjp2)" = "2.5.4"
       - name: Build and test optional feature
         run: |
           cargo test -p libremetaverse-imaging --features jpeg2000
diff --git a/.gitea/workflows/skia.yml b/.gitea/workflows/skia.yml
index 0e633bc..08a897a 100644
--- a/.gitea/workflows/skia.yml
+++ b/.gitea/workflows/skia.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Install native link prerequisites
         run: |
           sudo apt-get update
-          sudo apt-get install --yes curl pkg-config libfontconfig1-dev libfreetype6-dev
+          sudo apt-get install --yes build-essential clang curl ninja-build pkg-config python3 libfontconfig1-dev libfreetype6-dev
       - name: Test default and Skia feature builds
         run: |
           cargo test -p libremetaverse-imaging-skia --no-default-features
diff --git a/tools/check_milestone_06.py b/tools/check_milestone_06.py
index 3712148..9c8d603 100644
--- a/tools/check_milestone_06.py
+++ b/tools/check_milestone_06.py
@@ -109,10 +109,15 @@ def check_benchmarks_and_ci() -> None:
     for name, path in workflows.items():
         if not path.is_file():
             raise SystemExit(f"missing {name} native-feature workflow")
-        text = path.read_text().lower()
-        missing = [platform for platform in ("linux", "macos", "windows") if platform not in text]
-        if missing:
-            raise SystemExit(f"{name} workflow lacks platforms: " + ", ".join(missing))
+        runners = re.findall(r"(?m)^\s*runs-on:\s*([^\s#]+)", path.read_text().lower())
+        if not runners:
+            raise SystemExit(f"{name} workflow has no runner")
+        unsupported = sorted({runner for runner in runners if runner != "ubuntu-latest"})
+        if unsupported:
+            raise SystemExit(
+                f"{name} workflow must use only ubuntu-latest, found: "
+                + ", ".join(unsupported)
+            )
 
 
 def main() -> None:
@@ -122,7 +127,7 @@ def main() -> None:
     check_benchmarks_and_ci()
     print(
         "milestone 06 audit: owned Rust has no stubs; 48 reviewed parity cases, "
-        "optional native features, benchmarks, and cross-platform workflows are complete"
+        "optional native features, benchmarks, and Linux-only Gitea workflows are complete"
     )