diff --git a/.github/workflows/sync-packagist.yml b/.github/workflows/sync-packagist.yml
index c6f8503..478c0ce 100644
--- a/.github/workflows/sync-packagist.yml
+++ b/.github/workflows/sync-packagist.yml
@@ -4,13 +4,25 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      publish:
+        description: Trigger Packagist after validation
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
 
 jobs:
   packagist:
     name: Trigger Packagist update
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, nvoip-ci-public-release]
     steps:
+      - name: Validate runner dependencies
+        run: curl --version
       - name: Update package metadata
+        if: github.event_name == 'release' || inputs.publish
         run: |
           curl -fsS -X POST \
             -H "content-type: application/json" \