diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e0eea70..ca77f3ac 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,7 @@ defaults:
 
 jobs:
   static:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -66,7 +66,7 @@ jobs:
 
   unit:
     name: unit (${{ matrix.leg }})
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -132,7 +132,7 @@ jobs:
 
   # The matrix of the next job, from tests/run.sh --list.
   integration-files:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -165,7 +165,7 @@ jobs:
 
   integration:
     needs: integration-files
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     permissions:
       contents: read
@@ -184,7 +184,7 @@ jobs:
         run: tests/run.sh integration "$TEST_FILE"
 
   worker:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
@@ -209,7 +209,7 @@ jobs:
   # directories frees less, and that is worth a warning, not a red run.
   # debloat-runner failing outright still fails the job.
   debloat:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -234,7 +234,7 @@ jobs:
   # So Renovate may merge a new keyring_image digest on its own while the
   # keys stay the same, and a change of keys waits for a person.
   keyrings:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
diff --git a/.github/workflows/status.yml b/.github/workflows/status.yml
index 64981808..d20addca 100644
--- a/.github/workflows/status.yml
+++ b/.github/workflows/status.yml
@@ -52,7 +52,7 @@ jobs:
   # in either direction.
   kick:
     if: ${{ github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       actions: write
@@ -71,7 +71,7 @@ jobs:
           exit "$rc"
 
   decide:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -123,7 +123,7 @@ jobs:
   bench:
     needs: decide
     if: ${{ needs.decide.outputs.bench == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: read
@@ -153,7 +153,7 @@ jobs:
   build:
     needs: [decide, bench]
     if: ${{ !cancelled() && needs.decide.result == 'success' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       contents: write
@@ -282,7 +282,7 @@ jobs:
   deploy:
     needs: build
     if: ${{ !cancelled() && needs.build.result == 'success' && github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       pages: write
@@ -334,7 +334,7 @@ jobs:
   worker:
     needs: build
     if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/sync-target.yml b/.github/workflows/sync-target.yml
index b9b2583a..749e78ef 100644
--- a/.github/workflows/sync-target.yml
+++ b/.github/workflows/sync-target.yml
@@ -55,7 +55,7 @@ jobs:
   # still runs out keeps the results of the files that ended.
   mirror:
     if: ${{ inputs.shards != '[]' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 250
     permissions:
       contents: read
@@ -125,7 +125,7 @@ jobs:
   stage:
     needs: mirror
     if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -172,7 +172,7 @@ jobs:
   verify:
     needs: stage
     if: ${{ !cancelled() && needs.stage.result == 'success' && needs.stage.outputs.has_batches == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 95
     permissions:
       contents: read
@@ -228,7 +228,7 @@ jobs:
   promote:
     needs: [stage, verify]
     if: ${{ !cancelled() && needs.stage.result == 'success' && github.ref == 'refs/heads/main' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -285,7 +285,7 @@ jobs:
   summary:
     needs: [mirror, stage, verify, promote]
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 25
     # packages: write, because index-write pushes the target's index tag.
     permissions:
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 59be93bf..64c138bf 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -95,7 +95,7 @@ env:
 
 jobs:
   plan:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # These fit under 40 min: 20 min of upstream reads (PLAN_BUDGET), 4 min
     # of registry reads (REGISTRY_READ_BUDGET), and up to about 9 min more
     # for the registry read in progress when that budget is spent. The
@@ -411,7 +411,7 @@ jobs:
   report:
     needs: [plan, target]
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       actions: write
@@ -472,7 +472,7 @@ jobs:
   # No needs, in either direction: this runs whatever the sync does, and the
   # watchdog workflow runs the same two checks, so each witnesses the other.
   keepalive:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       actions: write
diff --git a/.github/workflows/upstream-watch.yml b/.github/workflows/upstream-watch.yml
index 517604a0..577baeec 100644
--- a/.github/workflows/upstream-watch.yml
+++ b/.github/workflows/upstream-watch.yml
@@ -41,7 +41,7 @@ defaults:
 
 jobs:
   watch:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # WATCH_BUDGET (300 s) of HEAD requests, then dispatch-sync under its own
     # 120 s limit, fit in 10 minutes.
     timeout-minutes: 10
diff --git a/.github/workflows/watchdog.yml b/.github/workflows/watchdog.yml
index f1fef49e..7a1f4737 100644
--- a/.github/workflows/watchdog.yml
+++ b/.github/workflows/watchdog.yml
@@ -26,7 +26,7 @@ defaults:
 
 jobs:
   staleness:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -122,7 +122,7 @@ jobs:
           scripts/check-status-site "$RUNNER_TEMP/status-branch.json"
 
   schedules:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       actions: write
diff --git a/.github/workflows/worker.yml b/.github/workflows/worker.yml
index 01bea282..7b68cc68 100644
--- a/.github/workflows/worker.yml
+++ b/.github/workflows/worker.yml
@@ -28,7 +28,7 @@ defaults:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     permissions:
       contents: read