diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index eef56d2..22d1840 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -9,26 +9,48 @@ on:
 concurrency:
   group: ${{ github.workflow }}.${{ github.ref }}
 
+# Recommended here: https://github.com/bazelbuild/bazelisk/issues/88#issuecomment-625178467
+env:
+  BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  OPAL_RPC_CREDENTIALS: ${{ secrets.OPAL_RPC_CREDENTIALS }}
+
 jobs:
-  bazel-builder:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+  test-matrix:
+    runs-on:
+      - self-hosted
+      - "os=${{ matrix.os }}"
+      - "arch=${{ matrix.arch }}"
+      - "os_distribution=${{ matrix.os_distribution }}"
+      - "os_version=${{ matrix.os_version }}"
+      - "revision=${{ matrix.revision }}"
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: "linux"
+            arch: "x64"
+            os_distribution: "debian"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
-    steps:
-      - uses: actions/checkout@v4
-      - name: run all tests
-        run: |
-          bazel test --config=noninteractive //...
+          - os: "macos"
+            arch: "x64"
+            os_distribution: "monterey"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
-  golang-builder:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+          - os: "windows"
+            arch: "x64"
+            os_distribution: "debian"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
     steps:
       - uses: actions/checkout@v4
-      - name: build all
-        run: |
-          go build ./...
-      - name: run all tests
+
+      - name: Test with Bazel
         run: |
-          go test ./...
+          # TODO(CUS-345): Enable remote execution
+          bazel test --config=noninteractive //...
diff --git a/.github/workflows/presubmit.yml b/.github/workflows/presubmit.yml
index 864dbaf..4041e92 100644
--- a/.github/workflows/presubmit.yml
+++ b/.github/workflows/presubmit.yml
@@ -11,28 +11,48 @@ concurrency:
   group: ${{ github.workflow }}.${{ github.ref }}
   cancel-in-progress: true
 
+# Recommended here: https://github.com/bazelbuild/bazelisk/issues/88#issuecomment-625178467
+env:
+  BAZELISK_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  OPAL_RPC_CREDENTIALS: ${{ secrets.OPAL_RPC_CREDENTIALS }}
+
 jobs:
-  bazel-builder:
-    # TODO(scott): Move to CI runners
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+  test-matrix:
+    runs-on:
+      - self-hosted
+      - "os=${{ matrix.os }}"
+      - "arch=${{ matrix.arch }}"
+      - "os_distribution=${{ matrix.os_distribution }}"
+      - "os_version=${{ matrix.os_version }}"
+      - "revision=${{ matrix.revision }}"
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: "linux"
+            arch: "x64"
+            os_distribution: "debian"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
-    steps:
-      - uses: actions/checkout@v4
-      - name: run all tests
-        run: |
-          bazel test --config=noninteractive //...
+          - os: "macos"
+            arch: "x64"
+            os_distribution: "monterey"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
-  golang-builder:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+          - os: "windows"
+            arch: "x64"
+            os_distribution: "debian"
+            os_version: "12"
+            revision: "d04e89854b3931f4aaced77aa3a2fcad5834b3a6"
 
     steps:
-      - name: checkout
-        uses: actions/checkout@v4
-      - name: build all
-        run: |
-          go build ./...
-      - name: run all tests
+      - uses: actions/checkout@v4
+
+      - name: Test with Bazel
         run: |
-          go test ./...
+          # TODO(CUS-345): Enable remote execution
+          bazel test --config=noninteractive //...