diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index ecb38fc..0aa06e5 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   CLAAssistant:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Generate token from GitHub App
         id: app-token
diff --git a/.github/workflows/daily-update.yml b/.github/workflows/daily-update.yml
index 2c9f66c..172b428 100644
--- a/.github/workflows/daily-update.yml
+++ b/.github/workflows/daily-update.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
 
diff --git a/.github/workflows/docker-tests.yml b/.github/workflows/docker-tests.yml
index a489ef8..679c8e2 100644
--- a/.github/workflows/docker-tests.yml
+++ b/.github/workflows/docker-tests.yml
@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   docker-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v7
@@ -33,7 +33,7 @@ jobs:
           python test_docker.py
 
   docker-publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: docker-test
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/stable' }}
 
diff --git a/.github/workflows/pipeline-tests.yml b/.github/workflows/pipeline-tests.yml
index 6131f5a..07a72fa 100644
--- a/.github/workflows/pipeline-tests.yml
+++ b/.github/workflows/pipeline-tests.yml
@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     
     steps:
     - uses: actions/checkout@v7
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index c3beb6d..1cc554a 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
@@ -44,7 +44,7 @@ jobs:
         uv run pytest test_cloudcheck.py -v
 
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: test
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     permissions:
@@ -65,7 +65,7 @@ jobs:
         with:
           python-version: "3.x"
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # 2026-09-03, no release tag
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
       - name: Get current version
@@ -254,7 +254,7 @@ jobs:
           path: dist
 
   sdist:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: publish
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     steps:
@@ -272,7 +272,7 @@ jobs:
 
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: [linux, musllinux, windows, macos, sdist]
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     permissions:
diff --git a/.github/workflows/rust-tests.yml b/.github/workflows/rust-tests.yml
index ae2e56b..d95c4cf 100644
--- a/.github/workflows/rust-tests.yml
+++ b/.github/workflows/rust-tests.yml
@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     
     steps:
       - uses: actions/checkout@v7
@@ -41,7 +41,7 @@ jobs:
 
   publish:
     needs: test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
     
     steps: