diff --git a/.ci/docker/build.sh b/.ci/docker/build.sh
index 774f54541b..ffb737ff8d 100755
--- a/.ci/docker/build.sh
+++ b/.ci/docker/build.sh
@@ -10,7 +10,7 @@ set -exu
 IMAGE_NAME="$1"
 shift
 
-export UBUNTU_VERSION="22.04"
+export UBUNTU_VERSION="24.04"
 export CUDA_VERSION="12.6.3"
 
 export BASE_IMAGE="nvidia/cuda:${CUDA_VERSION}-devel-ubuntu${UBUNTU_VERSION}"
diff --git a/.ci/docker/common/install_base.sh b/.ci/docker/common/install_base.sh
index 3100b550a8..cb0188a871 100644
--- a/.ci/docker/common/install_base.sh
+++ b/.ci/docker/common/install_base.sh
@@ -10,7 +10,7 @@ install_ubuntu() {
   apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
-    cmake=3.22* \
+    cmake \
     curl \
     git \
     wget \
diff --git a/.ci/docker/common/install_pip_requirements.sh b/.ci/docker/common/install_pip_requirements.sh
index a548d20046..0c576765ac 100644
--- a/.ci/docker/common/install_pip_requirements.sh
+++ b/.ci/docker/common/install_pip_requirements.sh
@@ -2,6 +2,11 @@
 
 set -ex
 
+# Ubuntu 24.04 marks the system Python as externally managed (PEP 668). Allow
+# pip to install into it for every user, including the later `sudo pip` calls.
+printf '[global]\nbreak-system-packages = true\n' > /etc/pip.conf
+
 # Install pip packages
-pip install --upgrade pip
+# --ignore-installed: the apt-installed pip has no RECORD file to uninstall from.
+pip install --upgrade --ignore-installed pip
 pip install -r ./requirements.txt
diff --git a/.ci/docker/requirements.txt b/.ci/docker/requirements.txt
index 5c7f2565b7..157647e887 100644
--- a/.ci/docker/requirements.txt
+++ b/.ci/docker/requirements.txt
@@ -20,7 +20,7 @@ pytorch_sphinx_theme2==0.4.9
 
 # Tutorial dependencies
 tqdm==4.66.1
-numpy==1.24.4
+numpy==1.26.4
 pydantic>=2.10
 # Pin fastapi: 0.139.2 made router route building thread-safe by adding an
 # _effective_routes_lock (threading.Lock) to APIRouter, which ray[serve]'s
@@ -39,7 +39,7 @@ bs4
 setuptools<81
 awscliv2==2.1.1
 flask
-spacy==3.7.1  # Keep this version consistent with the model version in .jenkins/build.sh
+spacy==3.7.2  # Keep this version consistent with the model version in .jenkins/build.sh
 # Pin protobuf: ray[serve]==2.55.0 uses FieldDescriptor.label, removed in protobuf>=6.
 protobuf<6
 ray[serve,train,tune]==2.55.0
@@ -77,8 +77,8 @@ pandas
 requests
 aiohttp
 scikit-image
-scipy==1.11.1
-numba==0.57.1
+scipy==1.11.4
+numba==0.59.1
 pillow==10.2.0
 wget
 gym==0.26.2