diff --git a/.github/workflows/_ci.yml b/.github/workflows/_ci.yml
index 67372c0..a8b0c80 100644
--- a/.github/workflows/_ci.yml
+++ b/.github/workflows/_ci.yml
@@ -10,17 +10,17 @@ on:
 
 jobs:
   lint:
-    # ubuntu-latest while arc-dind runners are unavailable during the libvirt
+    # GitHub-hosted Ubuntu while arc-dind runners are unavailable during the libvirt
     # migration. Revert to `arc` once the new k3s cluster has ARC runners up.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7.0.0
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Run pre-commit
         uses: pre-commit/action@v3.0.1
diff --git a/.github/workflows/opentofu.yml b/.github/workflows/opentofu.yml
index 84fd446..bfc5706 100644
--- a/.github/workflows/opentofu.yml
+++ b/.github/workflows/opentofu.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -61,17 +61,17 @@ jobs:
     needs: [test]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Configure AWS credentials for SOPS KMS
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6.2.3
         with:
           role-to-assume: ${{ inputs.aws-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
       - name: Install SSH key
         if: ${{ inputs.setup-ssh }}
-        uses: shimataro/ssh-key-action@v2
+        uses: shimataro/ssh-key-action@v2.8.1
         with:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
@@ -122,7 +122,7 @@ jobs:
           } > comment-body.md
 
       - name: comment
-        uses: johanwulf/replace-comment@v1.0.0
+        uses: johanwulf/replace-comment@v1.0.1
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body-includes: '<!-- opentofu-plan -->'
@@ -144,17 +144,17 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
 
       - name: Configure AWS credentials for SOPS KMS
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6.2.3
         with:
           role-to-assume: ${{ inputs.aws-role-to-assume }}
           aws-region: ${{ inputs.aws-region }}
 
       - name: Install SSH key
         if: ${{ inputs.setup-ssh }}
-        uses: shimataro/ssh-key-action@v2
+        uses: shimataro/ssh-key-action@v2.8.1
         with:
           key: ${{ secrets.SSH_PRIVATE_KEY }}
           known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
diff --git a/README.md b/README.md
index ba8fac5..1e4118a 100644
--- a/README.md
+++ b/README.md
@@ -33,9 +33,12 @@ jobs:
 |----------|-------------|
 | `opentofu.yml` | OpenTofu/Terraform CI/CD with plan comments and apply on merge |
 
-## Container
+## Runners
 
-All workflows use `ghcr.io/makeitworkcloud/runner:latest`.
+Repository CI runs on `ubuntu-24.04`. The reusable OpenTofu workflow defaults
+to the `arc-tf` runner, whose pod uses the `tfroot-runner` image directly. That
+image uses Actions Runner `2.336.0`, above the `2.327.1` minimum required by
+the workflows' Node 24 actions.
 
 See [images](https://github.com/makeitworkcloud/images) for container source and included tools.