diff --git a/.github/workflows/call-test-deploy.yml b/.github/workflows/call-test-deploy.yml
index ca454e0e46..dc3e52ad1b 100644
--- a/.github/workflows/call-test-deploy.yml
+++ b/.github/workflows/call-test-deploy.yml
@@ -308,6 +308,11 @@ jobs:
         shell: bash
         run: ./scripts/github/runner/relocate_docker_dataroot.sh
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: 🔍 Resolve repository owner
         shell: bash
         run: |
diff --git a/.github/workflows/call-test-dns.yml b/.github/workflows/call-test-dns.yml
index d993811a4b..05c4c9ed3b 100644
--- a/.github/workflows/call-test-dns.yml
+++ b/.github/workflows/call-test-dns.yml
@@ -41,6 +41,11 @@ jobs:
       - name: ⬇️ Checkout
         uses: actions/checkout@v7.0.0
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: 🔑 Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
diff --git a/.github/workflows/call-test-workspace.yml b/.github/workflows/call-test-workspace.yml
index 4c748b56e4..a888feb280 100644
--- a/.github/workflows/call-test-workspace.yml
+++ b/.github/workflows/call-test-workspace.yml
@@ -88,6 +88,11 @@ jobs:
       - name: ⬇️ Checkout repository
         uses: actions/checkout@v7.0.0
 
+      - name: 🛡️ Tear down host AppArmor profiles (dev-host parity)
+        if: ${{ !env.ACT }}
+        shell: bash
+        run: make security-apparmor-teardown
+
       - name: "📥 Load the rescue paths into job env"
         shell: bash
         run: |