diff --git a/.github/workflows/bats.yml b/.github/workflows/bats.yml
index 3c0176ba..d6e8514b 100644
--- a/.github/workflows/bats.yml
+++ b/.github/workflows/bats.yml
@@ -34,7 +34,7 @@ permissions:
 jobs:
   test:
     name: BATS
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
diff --git a/.github/workflows/cleanup-packages.yaml b/.github/workflows/cleanup-packages.yaml
index 37b51b93..c24bacab 100644
--- a/.github/workflows/cleanup-packages.yaml
+++ b/.github/workflows/cleanup-packages.yaml
@@ -43,7 +43,7 @@ permissions:
 jobs:
   cleanup:
     name: Prune untagged devcontainer digests
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
diff --git a/.github/workflows/devcontainer-prebuild.yaml b/.github/workflows/devcontainer-prebuild.yaml
index 882d3fee..3d107613 100644
--- a/.github/workflows/devcontainer-prebuild.yaml
+++ b/.github/workflows/devcontainer-prebuild.yaml
@@ -168,7 +168,7 @@ jobs:
 
   merge:
     name: Create Multi-Platform Manifest
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: prebuild
     # Merge when images were actually pushed: main, schedule, dispatch, or v* tag.
     if: |
@@ -330,7 +330,7 @@ jobs:
       - prebuild
       - merge
     if: ${{ always() && github.event_name != 'pull_request' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index b7d4c979..60d845d4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -25,7 +25,7 @@ permissions:
 jobs:
   build:
     name: Build docs
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden runner
         # renovate: datasource=github-tags depName=DevSecNinja/.github
@@ -56,7 +56,7 @@ jobs:
 
   deploy:
     name: Deploy to GitHub Pages
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: build
     if: github.event_name == 'push'
     permissions:
@@ -81,7 +81,7 @@ jobs:
       - build
       - deploy
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index b8caf7ce..abf9031e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -49,7 +49,7 @@ jobs:
     needs:
       - release-please
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 602028bd..7d3f1ec4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,7 +40,7 @@ concurrency:
 jobs:
   release:
     name: Build, attest, and publish
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       # Required by actions/attest-build-provenance to mint the OIDC token
@@ -169,7 +169,7 @@ jobs:
     # condition meaningful; the action itself derives resolved-vs-firing
     # from `needs.release.result`.
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/sign-powershell.yml b/.github/workflows/sign-powershell.yml
index b7ba2ff7..3872d324 100644
--- a/.github/workflows/sign-powershell.yml
+++ b/.github/workflows/sign-powershell.yml
@@ -103,7 +103,7 @@ jobs:
     needs:
       - sign-scripts
     if: ${{ always() && github.ref == 'refs/heads/main' && github.event_name == 'push' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/todo-to-issue.yml b/.github/workflows/todo-to-issue.yml
index 45a2d9dd..798f3673 100644
--- a/.github/workflows/todo-to-issue.yml
+++ b/.github/workflows/todo-to-issue.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   run:
     name: "Run Todo to Issue"
-    runs-on: "ubuntu-24.04"
+    runs-on: "ubuntu-26.04"
     timeout-minutes: 10
     steps:
       - name: Harden runner