diff --git a/.github/workflows/test-backends.yml b/.github/workflows/test-backends.yml
index 3f43d7cb1..96c981c3c 100644
--- a/.github/workflows/test-backends.yml
+++ b/.github/workflows/test-backends.yml
@@ -88,6 +88,7 @@ jobs:
   namd-main-arm64:
     name: NAMD (main ARM64)
     uses: ./.github/workflows/backend-template.yml
+    if: ${{ !github.event.repository.private }}  # ARM64 runners only work for public repos
     with:
       runner_name: ubuntu-24.04-arm
       backend_name: NAMD
diff --git a/.github/workflows/test-library.yml b/.github/workflows/test-library.yml
index 449814a41..738bc122b 100644
--- a/.github/workflows/test-library.yml
+++ b/.github/workflows/test-library.yml
@@ -11,8 +11,6 @@ jobs:
 
     name: Basic checks
     runs-on: ubuntu-latest
-    outputs:
-      hassecrets: ${{ steps.checksecrets.outputs.hassecrets }}
     # env:
     #   CCACHE: ccache
     #   CCACHE_DIR: ${{ github.workspace }}/ccache
@@ -543,9 +541,11 @@ jobs:
         # We need to set CMAKE_SYSTEM_NAME manually in script mode
         run: cmake -D CMAKE_SYSTEM_NAME=Darwin -P devel-tools/build_test_library.cmake
 
+
   build-linux-ARM64-gcc:
     name: Linux ARM64 (GCC, Clang)
     runs-on: ubuntu-24.04-arm
+    if: ${{ !github.event.repository.private }}  # ARM64 runners only work for public repos
     needs: basicchecks
     env:
       CCACHE: ccache
@@ -596,3 +596,52 @@ jobs:
           path: |
             ${{ github.workspace }}/build_C++20/Testing/Temporary/*.log
             ${{ github.workspace }}/build_g++11_C++20/Testing/Temporary/*.log
+
+  build-linux-x86_64-self-hosted:
+    name: Linux x86_64 (self-hosted)
+    if: github.repository_visibility == 'private'
+    runs-on: [self-hosted, linux, x64]
+    needs: basicchecks
+    env:
+      CCACHE: ccache
+      CMAKE_GENERATOR: Ninja
+      CCACHE_DIR: ${{ github.workspace }}/ccache
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Load compiler ccache
+        uses: actions/cache@v4
+        with:
+          path: ${{ github.workspace }}/ccache
+          key: ${{ runner.os }}-${{ runner.arch }}-self-hosted-build-${{ github.sha }}
+          restore-keys: ${{ runner.os }}-${{ runner.arch }}-self-hosted-build-
+
+      - name: Get small downloadable packages
+        uses: actions/checkout@v4
+        with:
+          repository: 'Colvars/build-tools-packages'
+          ref: 'master'
+          path: 'devel-tools/packages'
+
+      - name: Get container images for build environment
+        shell: bash
+        working-directory: devel-tools
+        run: |
+          apptainer pull CentOS9-devel.sif oras://ghcr.io/colvars/devel-containers:CentOS9-devel
+
+      - name: Build with C++17 and Clang
+        env:
+          CXX_STANDARD: 17
+          CXX: clang++
+          CC: clang
+        run: |
+          apptainer exec ${{github.workspace}}/devel-tools/CentOS9-devel.sif \
+          cmake -D CMAKE_CXX_STANDARD=${CXX_STANDARD} -P devel-tools/build_test_library.cmake
+
+      - name: Keep only one cache besides the one from this job
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bash ${{ github.workspace }}/devel-tools/cleanup-gh-cache.sh ${{ runner.os }}-${{ runner.arch }}-self-hosted-build-
diff --git a/devel-tools/containers/CentOS9-devel.def b/devel-tools/containers/CentOS9-devel.def
index e3a5f3e56..66aa53563 100644
--- a/devel-tools/containers/CentOS9-devel.def
+++ b/devel-tools/containers/CentOS9-devel.def
@@ -40,6 +40,9 @@ From: quay.io/centos/centos:stream9
         inkscape gimp wget \
 	squashfs-tools
 
+    # The Clang package installs environment-modules, which conflicts with Lmod
+    alternatives --set modules.sh /usr/share/lmod/lmod/init/profile
+
     source /etc/profile
     module load mpi
 
@@ -69,14 +72,8 @@ From: quay.io/centos/centos:stream9
     curl -o /tmp/libtorch.zip https://download.pytorch.org/libtorch/cpu/libtorch-cxx11-abi-shared-with-deps-2.4.1%2Bcpu.zip
     unzip /tmp/libtorch.zip -d /opt
 
-    # Install GitHub CLI
-    dnf -y config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
-    dnf -y install gh --repo gh-cli
-
-    # Download pre-built recent CMake (mostly for GROMACS)
+    # Download pre-built executable of recent CMake (mostly for GROMACS)
     rm -fr /opt/cmake
     mkdir -p /opt/cmake
-    # export GH_TOKEN=xxxxx (will needs this to run gh even on public repos)
-    # gh release download v3.30.5 --repo https://github.com/Kitware/CMake --clobber --pattern '*linux-x86_64.sh'
-    wget https://github.com/Kitware/CMake/releases/download/v3.31.5/cmake-3.31.5-linux-x86_64.sh
-    bash cmake-3.31.5-linux-x86_64.sh  --skip-license --prefix=/opt/cmake
+    wget https://github.com/Kitware/CMake/releases/download/v4.1.2/cmake-4.1.2-linux-x86_64.sh
+    bash cmake-4.1.2-linux-x86_64.sh --skip-license --prefix=/opt/cmake
diff --git a/devel-tools/load-openmpi.sh b/devel-tools/load-openmpi.sh
index 320d41e2a..ccdca45ef 100644
--- a/devel-tools/load-openmpi.sh
+++ b/devel-tools/load-openmpi.sh
@@ -1,11 +1,12 @@
-# Ensure that Lmod is properly initialized
+# Ensure that the module command is properly initialized
 if [ -f /etc/profile.d/modules.sh ] ; then
     source /etc/profile.d/modules.sh
 fi
 
-if declare -f module >& /dev/null ; then
+if declare -f module >& /dev/null && [ -d /usr/share/modulefiles ] ; then
+    module use /usr/share/modulefiles
     # Default modulefile in OpenMPI RPM package
-    if module load mpi/openmpi-x86_64 >& /dev/null ; then
+    if module load mpi/openmpi-x86_64 ; then
         echo "Loaded OpenMPI version $(mpirun --version | head -n 1 | rev | cut -d' ' -f1 | rev)"
         if ompi_info --param btl vader | grep -q vader ; then
             # Enforce intra-node communication on recent OpenMPI versions