diff --git a/deploy/aks/scripts/test-build-hosts.sh b/deploy/aks/scripts/test-build-hosts.sh
index d22d821e75..1014dd7a6b 100755
--- a/deploy/aks/scripts/test-build-hosts.sh
+++ b/deploy/aks/scripts/test-build-hosts.sh
@@ -9,7 +9,7 @@
 #   2. the chart defaults render NO build-host object at all (buildHosts.enabled: false), so no
 #      estate changes until its record turns the hosts on;
 #   3. the fixture renders, per enabled channel, a Deployment with no `replicas` (KEDA owns it),
-#      images by DIGEST, the cibuild toleration + nodeSelector, the worker token from a Secret, the
+#      images by DIGEST, the ci-build toleration + nodeSelector, the worker token from a Secret, the
 #      build-cache claim, readiness on the staged marker, and a ScaledObject with minReplicaCount 0,
 #      the channel's maxReplicaCount and a metrics-api trigger on <apiUrl>/queue?channel=<c> with
 #      valueLocation demand and a scale-down stabilization window, the worker token as a mounted
@@ -102,8 +102,8 @@ for ch, (tester, portal, runner, mx, pv) in want.items():
         problems.append(f"{ch}: tester init image is not the channel's digest: {inits.get('tester', {}).get('image')}")
     if not inits.get("portal", {}).get("image", "").endswith("@sha256:" + portal * 16):
         problems.append(f"{ch}: portal init image is not the channel's digest: {inits.get('portal', {}).get('image')}")
-    if pod.get("nodeSelector") != {"workload": "cibuild"}:
-        problems.append(f"{ch}: nodeSelector is not workload=cibuild: {pod.get('nodeSelector')}")
+    if pod.get("nodeSelector") != {"workload": "ci-build"}:
+        problems.append(f"{ch}: nodeSelector is not workload=ci-build: {pod.get('nodeSelector')}")
     if not any(t.get("key") == "ci" and t.get("value") == "build" for t in pod.get("tolerations", [])):
         problems.append(f"{ch}: no ci=build toleration")
     if pod.get("serviceAccountName") != "build-host" or pod.get("automountServiceAccountToken") is not False:
diff --git a/deploy/helm/values.yaml b/deploy/helm/values.yaml
index bc6818c1ff..55559107da 100644
--- a/deploy/helm/values.yaml
+++ b/deploy/helm/values.yaml
@@ -1138,7 +1138,7 @@ buildHosts:
   orasImage: "ghcr.io/oras-project/oras:v1.3.4@sha256:f7bc056d54d97baa399414ed5048ecc67c3371b750d4bbce1d871827a5758179"
   # The tainted build pool (Build service §1.4): one build = one node.
   nodeSelector:
-    workload: cibuild
+    workload: ci-build              # the CI node pools (cibuildv6, cidind) carry workload=ci-build — the same label the ARC runners select
   tolerations:
     - { key: ci, operator: Equal, value: build, effect: NoSchedule }
     - { key: kubernetes.azure.com/scalesetpriority, operator: Equal, value: spot, effect: NoSchedule }