diff --git a/protocol/types.go b/protocol/types.go
index 4775b4a..d3abdea 100644
--- a/protocol/types.go
+++ b/protocol/types.go
@@ -1019,14 +1019,19 @@ func (c ProviderRuntimeContract) Validate() error {
 }
 
 func (c ProviderRuntimeContract) SupportsProduct(product NetworkProduct) bool {
+	_, ok := c.RuntimeProfileForRequirements(product.SecurityFloor)
+	return ok
+}
+
+func (c ProviderRuntimeContract) RuntimeProfileForRequirements(req PlacementRequirements) (ProviderRuntimeProfile, bool) {
 	for _, profile := range c.Profiles {
-		if profile.ExecutorProvider == product.SecurityFloor.ExecutorProvider &&
-			profile.ExecutionSecurityTier == product.SecurityFloor.ExecutionSecurityTier &&
-			profile.ProofTier == product.SecurityFloor.ProofTier {
-			return true
+		if profile.ExecutorProvider == req.ExecutorProvider &&
+			profile.ExecutionSecurityTier == req.ExecutionSecurityTier &&
+			profile.ProofTier == req.ProofTier {
+			return profile, true
 		}
 	}
-	return false
+	return ProviderRuntimeProfile{}, false
 }
 
 type ProviderRuntimeProfile struct {
diff --git a/protocol/types_test.go b/protocol/types_test.go
index bd31ddc..b0f8e79 100644
--- a/protocol/types_test.go
+++ b/protocol/types_test.go
@@ -811,6 +811,37 @@ func TestDefaultProviderRuntimeContractBuildsRuntimeMatrix(t *testing.T) {
 	}
 }
 
+func TestProviderRuntimeContractSelectsProfileForPlacementRequirements(t *testing.T) {
+	contract := protocol.DefaultProviderRuntimeContract(
+		[]string{"sandboxed-command", "service-sandboxed-container"},
+		[]protocol.ExecutionSecurityTier{protocol.ExecutionSandboxedContainer},
+		[]protocol.ProofTier{protocol.ProofArtifactHash},
+		protocol.ProviderRuntimeContractOptions{},
+	)
+
+	profile, ok := contract.RuntimeProfileForRequirements(protocol.PlacementRequirements{
+		ExecutorProvider:      "service-sandboxed-container",
+		ExecutionSecurityTier: protocol.ExecutionSandboxedContainer,
+		ProofTier:             protocol.ProofArtifactHash,
+	})
+
+	if !ok {
+		t.Fatal("expected matching runtime profile")
+	}
+	if profile.ExecutorProvider != "service-sandboxed-container" ||
+		profile.ExecutionSecurityTier != protocol.ExecutionSandboxedContainer ||
+		profile.ProofTier != protocol.ProofArtifactHash {
+		t.Fatalf("selected runtime profile = %+v", profile)
+	}
+	if _, ok := contract.RuntimeProfileForRequirements(protocol.PlacementRequirements{
+		ExecutorProvider:      "node-service-sandboxed-container",
+		ExecutionSecurityTier: protocol.ExecutionSandboxedContainer,
+		ProofTier:             protocol.ProofArtifactHash,
+	}); ok {
+		t.Fatal("unexpected runtime profile match for unsupported executor")
+	}
+}
+
 func TestDefaultProviderRuntimeProfileMatchesKnownExecutorShapes(t *testing.T) {
 	tests := []struct {
 		executor               string