GitHub Actions blocks self-hosted runners below 2.329.0
Since September 29, 2026, GitHub rejects self-hosted runners older than 2.329.0 and stops jobs on runners that miss a 30-day update window.
3 min read

By the numbers
- minimum runner version to register
- 2.329.0
- to install each new runner release
- 30 days
- Actions jobs a day on GitHub's rebuilt backend
- 120M+
GitHub began full enforcement of its minimum version rule for self-hosted Actions runners on September 29, 2026. A GitHub changelog post moved the date from September 25. Runners older than version 2.329.0 can no longer register with GitHub Enterprise Cloud. Outdated runners that are already registered stop picking up jobs.
A self-hosted runner is the small program a team installs on its own machine to run GitHub Actions workflows, instead of using GitHub's hosted machines. Teams use them for special hardware, private networks or lower cost. A runner that was installed once and never updated can now stop a CI pipeline, the automated build and test system, with no code change at all.
The two version rules
Two separate limits apply, according to GitHub's timeline post from June 12, 2026.
| Rule | What it requires | What happens if you miss it |
|---|---|---|
| Registration | Runner version 2.329.0 or later | The runner cannot register or re-register |
| Job execution | Each new runner release installed within 30 days of its publication | The runner stops running jobs, even if it is already registered |
The job rule is the stricter of the two. Its minimum version sits above the registration minimum, and it keeps moving. A runner can be new enough to register and still too old to run a workflow.
Who is affected
The rule covers GitHub.com and GitHub Enterprise Cloud, GitHub's hosted service for companies. GitHub Enterprise Cloud with data residency, the edition that keeps data in a chosen region, has enforced it since July 31, 2026. GitHub Enterprise Server, the product companies install on their own servers, is not affected.
How the rollout got here
GitHub published the timeline in June and then ran brownouts. A brownout is a short, planned block that switches old runners off for a few hours so their owners notice before the real deadline.
For Enterprise Cloud, the brownouts ran from 11:00 AM to 3:00 PM Eastern time on set days. They grew each week, according to the June post.
| Week | Brownout days | What was blocked |
|---|---|---|
| 1 | August 24 | Registration |
| 2 | August 31, September 2 | Registration |
| 3 | September 7, 9, 11 | Registration and running jobs |
| 4 | September 14, 16, 18 | Registration and running jobs |
The reason behind the rule is infrastructure. DevOps.com reports that GitHub began rebuilding the backend services behind Actions in early 2024. The new platform handles more than 120 million jobs a day. It also lets enterprises start seven times more jobs per minute than before. Enforcing runner versions completes that migration by making sure every runner works on the new platform, DevOps.com says.
Checking your runners
GitHub's September 28 post also adds a REST API for runner version deprecations. It returns the registration and runtime deprecation dates for runner versions. A team can use it to see the next deadline coming, rather than learning about it from a failed job.
Runners with automatic updates turned on meet the 30-day rule by themselves, GitHub's June post says. Runners that someone upgrades by hand need a regular update schedule to stay inside the window.
What this means for developers
Check every self-hosted runner today, before a build fails. Make a list of each runner and the version it reports, and upgrade anything below 2.329.0 first. Those machines are already locked out of registration.
Then look at how each runner gets its updates. Runners baked into a virtual machine image or a container image are the usual trap. They start from whatever version was frozen into the image. Teams often turn automatic updates off to keep builds repeatable. Under a 30-day window, that image now needs a rebuild at least once a month.
Treat the rule as permanent, not as a one-time migration. Every new runner release starts a fresh 30-day clock. Put the runner version into the same patch routine as the operating system, and wire the deprecation API into your monitoring.
Watch for runners that go quiet. Before this rule, an idle runner usually meant a broken machine. Now it may mean GitHub has simply stopped sending it jobs.
Sources
- Self-hosted runner version enforcement date has moved - GitHub Changelog
- GitHub Actions: Minimum version enforcement timeline for self-hosted runners - GitHub Changelog
- GitHub Actions Gets Serious About Self-Hosted Runner Versions - DevOps.com
Related articles

SharePoint, MikroTik bugs hit CISA's exploited list
CISA added a Microsoft SharePoint Server bug and a MikroTik RouterOS exploit chain to its exploited-vulnerability list, with a patch deadline of September 28 for U.S. federal agencies.

CodeQL 2.27.1 adds a C++ query, reads Actions lock files
CodeQL 2.27.1 ships 498 default security queries across 170 CWEs, a new C/C++ check, Kotlin 2.4.20 support and awareness of Actions lock files.

Kubernetes 1.37 promotes rootless mode to beta
Kubernetes 1.37 moves KubeletInUserNamespace to beta. The kubelet, container runtimes, CNI plugins and kube-proxy can now all run as a non-root user.
The daily brief
Three to five stories a day, and what each one means for the people who build software. Free, no spam.