diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 45e8ded99b..fc8284bd13 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -195,7 +195,7 @@ architecture.
 
 The architecture is the one axis a deploy job cannot apply to itself: the distro
 is installed and the filesystem is built, but the CPU arrives with the runner.
-The matrix therefore carries the runner label with the row (`ubuntu-latest` for
+The matrix therefore carries the runner label with the row (`ubuntu-26.04` for
 amd64, `ubuntu-24.04-arm` for arm64), `runs-on` reads it, and the job asserts
 `uname -m` against what it was assigned before deploying anything, so a label
 that stops resolving to arm64 hardware fails loudly instead of reporting an
diff --git a/.github/workflows/call-images-build-ci.yml b/.github/workflows/call-images-build-ci.yml
index 6138190af8..2918de03ad 100644
--- a/.github/workflows/call-images-build-ci.yml
+++ b/.github/workflows/call-images-build-ci.yml
@@ -48,7 +48,7 @@ concurrency:
 jobs:
   pools:
     name: 🏗️ Pools
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.out.outputs.matrix }}
       image_tag: ${{ steps.out.outputs.image_tag }}
@@ -70,7 +70,7 @@ jobs:
   build:
     name: 💿 Images ${{ matrix.architecture }}
     needs: pools
-    runs-on: ${{ matrix.architecture == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    runs-on: ${{ matrix.architecture == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-26.04' }}
     strategy:
       fail-fast: false
       matrix:
@@ -196,7 +196,7 @@ jobs:
     name: 🏷️ One tag per distro
     needs: [pools, build]
     if: ${{ !(github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/entry-pr-translate.yml b/.github/workflows/entry-pr-translate.yml
index 1b4420608a..79654def5f 100644
--- a/.github/workflows/entry-pr-translate.yml
+++ b/.github/workflows/entry-pr-translate.yml
@@ -27,7 +27,7 @@ jobs:
   languages:
     name: 🗣️ Resolve machine-translatable languages
     if: vars.CI_ENABLE_AUTO_TRANSLATIONS == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       codes: ${{ steps.codes.outputs.codes }}
     steps:
@@ -53,7 +53,7 @@ jobs:
   extract:
     name: 📝 Extract catalogs
     if: vars.CI_ENABLE_AUTO_TRANSLATIONS == 'true' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: ⬇️ Checkout
@@ -86,7 +86,7 @@ jobs:
     needs:
       - languages
       - extract
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 340
     strategy:
       fail-fast: false