Skip to content
Engineering Insight

GitHub Actions Self-Hosted Runner Enforcement Is Active: How to Check Your CI Before Jobs Stop

GitHub Enterprise Cloud now enforces self-hosted runner version requirements. A healthy machine can still stop receiving jobs when the runner software falls outside the supported window.

Cloud and OperationsGitHub ActionsSelf-Hosted Runners
Continue to the analysis
CI runner lifecycle

A healthy machine can still become too old to receive GitHub Actions jobs.

Inside this Insight

What the article follows

1Check deployed runner versions
2Fix stale source images
3Monitor deprecation dates
Cloud and Operations

Written by

Shruti SaraswatAscent Innovate Software
Published
Cloud and Operations
Quick summary

GitHub Actions self-hosted runners now need regular version checks.

  • Full GitHub Enterprise Cloud enforcement began on September 29, 2026.
  • Runners below 2.329.0 cannot register or re-register.
  • The runtime requirement is separate and can move as GitHub releases newer runner versions.
  • Image-based runners need the source VM or container image updated, not only one running machine.
  • GitHub Enterprise Server is not included in this specific enforcement change.

What changed with GitHub Actions self-hosted runners in September 2026?

GitHub now enforces minimum software versions more strictly for self-hosted runners on GitHub Enterprise Cloud. Full enforcement began on September 29, 2026, which means the version installed on a self-hosted runner is now an operational requirement rather than something that can be ignored indefinitely.

A runner can still have a working machine, network connection, and service process while becoming too old to receive GitHub Actions work. That distinction is important because the server itself may appear healthy while workflow jobs remain queued or stop reaching it. When CI suddenly stops moving, the installed runner version now belongs near the top of the troubleshooting list.

Which GitHub Actions self-hosted runner versions can stop working?

GitHub states that self-hosted runners below version 2.329.0 cannot register or re-register on GitHub Enterprise Cloud. That is the registration requirement, but it is not the only version rule that matters.

Already registered runners also need to remain above GitHub's runtime support threshold for executing workflow jobs. That threshold is separate from the registration floor and can move as GitHub releases newer runner versions. A runner that registered successfully in the past can therefore become too old to continue receiving workflow work later.

The practical approach is to maintain a runner update process rather than treating one upgrade as a permanent solution. Runner software has to keep moving with the GitHub Actions service, particularly in environments where runners are created automatically from reusable images.

How to check GitHub Actions self-hosted runner versions

The first task is to create a simple inventory of the self-hosted runners currently in use. For a small setup, registered runners can be reviewed in GitHub under Settings → Actions → Runners. For organizations managing more runners, GitHub's REST API is more practical because runner information can be collected centrally and includes the installed version.

The inventory does not need to become a large monitoring project. A small table showing runner name, installed version, update method, and current status is enough to expose whether old software is still deployed or whether some runners have no clear maintenance path.

RunnerInstalled versionUpdate methodCurrent status
build-runner-01current versionautomaticidle
deploy-runner-02current versionVM imageactive
gpu-runner-01current versionmanualoffline

The important result is visibility. Self-hosted runners should not exist in production without a clear answer to which version is installed and how that version will be updated when GitHub changes the supported range.

What happens when a GitHub Actions self-hosted runner is outdated?

An outdated runner can fail in more than one way, which is why the problem can be confusing during an incident. A registration problem, a runtime compatibility problem, and a general machine problem can all appear as unavailable CI capacity even though they have different causes.

Runner registration can fail

A runner below the registration minimum cannot newly register or re-register. This can become visible after a machine is replaced, a runner is recreated, a VM or container image is redeployed, or registration is attempted again after configuration changes. A runner image that worked previously can therefore begin failing during a later deployment if the bundled runner package has become too old.

Workflow jobs can stop reaching an existing runner

A runner can already be registered and still fall below GitHub's runtime support requirement later. In that situation, the machine may still be online and the runner service may still exist, but GitHub can stop assigning workflow jobs to it. The operating system being healthy does not guarantee that the runner software is still compatible with the service.

GitHub Actions jobs can remain queued

When no compatible runner is available, a workflow may remain queued instead of immediately presenting the runner version as the obvious cause. That can make the incident look like a wider CI or infrastructure problem. Checking the runner version alongside connectivity, labels, status, and machine health can narrow the cause much faster.

How to update GitHub Actions self-hosted runners

GitHub self-hosted runners update automatically by default, so a normal long-running runner may already have the maintenance mechanism it needs. The first check is whether those automatic updates are actually completing. GitHub documents update activity in the runner logs, including files in the _diag directory, which can help show whether an update succeeded or whether the runner has fallen behind.

Some environments intentionally disable automatic runner updates because the runner software is controlled through a machine image, container image, or another repeatable deployment process. In that setup, updating the runner means updating the deployment source rather than changing one machine by hand.

GitHub states that runners with automatic updates disabled must be updated within 30 days of a new runner release. If a critical security update is required, GitHub can stop queueing jobs until that update is installed. The important operational decision is therefore to know whether a runner follows GitHub's automatic update path or an internal image and deployment lifecycle.

Image-based runners

How to update GitHub Actions runners created from VM or container images

Updating one running machine is not enough when future runners are created from a reusable VM or container image. If the source image still contains an old runner package, the next machine can recreate the same problem even after the current runner has been fixed.

01Package

Update the runner software

Move the runner package to the required supported version in the image or build process.
02Image

Rebuild the VM or container image

Make the updated runner part of the reusable source instead of fixing only one existing machine.
03Deploy

Create runners from the new image

Replace or rotate older runner instances according to the existing CI deployment process.
04Verify

Check the deployed runner versions

Confirm that newly created runners report the expected supported version after the new image is in use.

Route principle

In an image-based runner fleet, the reusable image is the long-lived source of truth. Fixing only one active machine does not prevent outdated runners from returning later.

Does GitHub Actions runner version enforcement affect GitHub Enterprise Server?

This specific September 2026 enforcement change applies to GitHub Enterprise Cloud. GitHub states that GitHub Enterprise Server is not affected by this enforcement change, so the September 29 enforcement schedule should not be copied directly onto a GitHub Enterprise Server environment.

That does not mean GitHub Enterprise Server runners never need updates. It means this particular GitHub Enterprise Cloud policy and deadline are not the correct source for determining Enterprise Server runner compatibility. The GitHub deployment type should therefore be confirmed before applying a version requirement or troubleshooting against the wrong support policy.

How to check GitHub Actions runner version deprecation dates

GitHub provides a REST API for runner-version deprecations, allowing registration and runtime end-of-life information to be checked for a specific runner version. That makes it possible to build a lightweight internal check instead of relying on a version number copied from an older announcement.

For an organization, the endpoint follows this form:

GET /orgs/{org}/actions/runners/deprecations/{version}

GitHub also provides a repository-level version of the endpoint. Using current deprecation information is a better long-term approach because the supported range can move over time. Instead of treating 2.329.0 as a permanent target, CI maintenance can identify runner versions approaching their registration or runtime deadline.

Runner check

GitHub Actions self-hosted runner update checklist

A short version review can prevent an avoidable CI interruption. The main requirement is to know which runner versions are deployed, how each runner receives updates, and whether reusable images are still creating machines with older software.

Runner inventory

List every GitHub Actions self-hosted runner and record the installed runner version.

Update method

Identify whether each runner updates automatically, manually, or through a VM or container image.

Automatic updates

Confirm that automatic runner updates are completing where automatic updates are enabled.

Source images

Rebuild reusable VM and container images when the runner package changes.

New runners

Check that newly created runners report the updated version instead of returning from an older image.

Deprecation dates

Use GitHub's current registration and runtime deprecation information instead of relying on one fixed minimum indefinitely.

GitHub deployment type

Keep GitHub Enterprise Cloud enforcement guidance separate from GitHub Enterprise Server guidance.

Queued workflows

Include runner version in the checks when workflow jobs unexpectedly remain queued.

Before moving on

Self-hosted runners are maintained software rather than a one-time machine installation. Version visibility should be part of normal CI maintenance.

The main rule for GitHub Actions self-hosted runners

A self-hosted runner should not be installed once and forgotten. GitHub Actions continues to evolve, and the runner software has to remain compatible with the service that assigns workflow jobs.

For a small setup, healthy automatic updates may be enough. For image-based or larger runner fleets, the runner version needs to become part of the normal deployment and monitoring process so an outdated package does not first become visible when an important workflow stops moving.

Sources

References used for this Insight

This Insight uses GitHub's current first-party changelog and documentation for runner enforcement, updates, deprecation information, and troubleshooting.

  1. 01

    GitHub

    Official sourceSep 28, 2026

    Self-hosted runner version enforcement date has moved

    Used for the September 29 enforcement date, version 2.329.0 registration floor, runtime enforcement, and GitHub Enterprise Cloud scope.

    Source
  2. 02

    GitHub Docs

    Documentation

    Self-hosted runners reference

    Used for automatic updates, disabled-update behaviour, the 30-day update requirement, and critical security update behaviour.

    Source
  3. 03

    GitHub Docs

    Documentation

    REST API endpoints for self-hosted runners

    Used for runner inventory and the organization and repository runner-version deprecation endpoints.

    Source
  4. 04

    GitHub Docs

    Documentation

    Monitoring and troubleshooting self-hosted runners

    Used for runner status, diagnostic logs, and monitoring the automatic update process.

    Source

Source links support the facts they are attached to. They do not imply that the source publisher endorses Ascent's interpretation or recommendations.