This seems like a great solution, I will definitely investigate that. I'm a bit worried about feature completeness (Vault integration comes to mind). Does anyone have experience with using this on a large scale?

You could run into some limitations, since as far as I know there is only 1 self hosted runner configuration for a given organization. You can’t for example request a specific workflow run on a specific class of self-hosted runners or something like that.