diff --git a/.github/actionlint.yml b/.github/actionlint.yml
new file mode 100644
index 0000000..a76f462
--- /dev/null
+++ b/.github/actionlint.yml
@@ -0,0 +1,5 @@
+self-hosted-runner:
+  # actionlint 1.7.12 predates the GitHub-hosted Ubuntu 26.04 images.
+  labels:
+    - ubuntu-26.04
+    - ubuntu-26.04-arm
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index fc2bd02..660541e 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -9,7 +9,7 @@ permissions: {}
 
 jobs:
   run:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     permissions:
       contents: read
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 921c86c..d3189af 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,11 +15,11 @@ jobs:
 
     strategy:
       matrix:
-        runs-on: [ubuntu-24.04, ubuntu-24.04-arm, macos-26]
+        runs-on: [ubuntu-26.04, ubuntu-26.04-arm, macos-26]
         include:
-          - runs-on: ubuntu-24.04
+          - runs-on: ubuntu-26.04
             arch: x86-64
-          - runs-on: ubuntu-24.04-arm
+          - runs-on: ubuntu-26.04-arm
             arch: arm64
           - runs-on: macos-26
             arch: arm64
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 8e0c396..554fbec 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -7,7 +7,7 @@ permissions: {}
 
 jobs:
   run:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     permissions:
       contents: read
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ee13963..4bf21b9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,7 +8,7 @@ permissions: {}
 jobs:
   run:
     name: ${{ matrix.toolchain }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     continue-on-error: ${{ matrix.toolchain != 'stable' }}
 
     permissions:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bbfd2cb..f6c0f35 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -16,11 +16,11 @@ jobs:
 
     strategy:
       matrix:
-        runs-on: [ubuntu-24.04, ubuntu-24.04-arm, macos-26]
+        runs-on: [ubuntu-26.04, ubuntu-26.04-arm, macos-26]
         include:
-          - runs-on: ubuntu-24.04
+          - runs-on: ubuntu-26.04
             arch: x86-64
-          - runs-on: ubuntu-24.04-arm
+          - runs-on: ubuntu-26.04-arm
             arch: arm64
           - runs-on: macos-26
             arch: arm64
@@ -83,11 +83,11 @@ jobs:
     # `net_*` tests self-skip there (the macOS `run` job leaves the URLs unset).
     strategy:
       matrix:
-        runs-on: [ubuntu-24.04, ubuntu-24.04-arm]
+        runs-on: [ubuntu-26.04, ubuntu-26.04-arm]
         include:
-          - runs-on: ubuntu-24.04
+          - runs-on: ubuntu-26.04
             arch: x86-64
-          - runs-on: ubuntu-24.04-arm
+          - runs-on: ubuntu-26.04-arm
             arch: arm64
 
     permissions:
diff --git a/mise.toml b/mise.toml
index 25fdbfe..df05691 100644
--- a/mise.toml
+++ b/mise.toml
@@ -14,6 +14,7 @@ hk = "1.55.0"
 jq = "latest"
 node = "24"
 pkl = "0.32"
+shellcheck = "0.11"
 taplo = "0.10"
 usage = "latest"
 zizmor = "1"