diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 632e46a..5e104dd 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,6 +39,7 @@ jobs:
   test:
     runs-on:
       group: ipsec-testing
+      labels: ["self-hosted", "X64", "distro:jammy"]  # balenaOS (balena-public-pki) tests require socat v1.7.4
     timeout-minutes: 60
     strategy:
       fail-fast: false