diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82bb5fb7d3..c6f1c9e002 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
     # Other workflows are likely ok to use standard GH runners for now.
     # Googlers, see b/460874304.
     # Bazel build and test support is currently validated on Linux only.
-    runs-on: linux-x86-n2-32
+    runs-on: linux-x86-n4-32
     # Pinned to a digest because zizmor's unpinned-images check rejects tags.
     # To refresh: crane digest <image>:latest
     container: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build@sha256:5544b5920fb9773007a2d61400dc70ba24ef03339cc521ac5ce89abc59b40eb7
diff --git a/ci/bazelrc b/ci/bazelrc
index f77a4073ac..b9a54a4be9 100644
--- a/ci/bazelrc
+++ b/ci/bazelrc
@@ -4,7 +4,7 @@ build --local_resources=memory=4000
 build --worker_max_instances=2
 
 # Ensure sandboxing is on to increase hermeticity.
-build --spawn_strategy=sandboxed
+build --spawn_strategy=processwrapper-sandbox
 build --worker_sandboxing
 # Bazel may materialize frontend/npm assets with CopyFile/CopyDirectory
 # actions that are not executable under processwrapper-sandbox alone.