diff --git a/.github/workflows/cache-cleanup.yml b/.github/workflows/cache-cleanup.yml
index 57a5ca7..358b313 100644
--- a/.github/workflows/cache-cleanup.yml
+++ b/.github/workflows/cache-cleanup.yml
@@ -22,7 +22,7 @@ permissions:
 
 jobs:
   cleanup:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - name: Delete caches nothing will read again
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27555df..c48d5ee 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
     uses: ./.github/workflows/stack-node.yml
     with:
       node-versions: '["22","24"]'
-      os: '["ubuntu-latest","windows-latest"]'
+      os: '["ubuntu-26.04","windows-latest"]'
       package-manager: npm
       install-command: npm ci
       cache: npm
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7b7af00..972c34f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJSON(inputs.languages) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       # code scanning alerts are security events
       security-events: write
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
index ebd1dd4..f99d972 100644
--- a/.github/workflows/commitlint.yml
+++ b/.github/workflows/commitlint.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   commitlint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index e752f01..302c695 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -21,7 +21,7 @@ jobs:
   automerge:
     # only Dependabot's own pull requests; everyone else's are merged by a person
     if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       # a run that Dependabot starts gets a read-only token unless the workflow asks for these
       contents: write
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 5f2e6f8..6e58588 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       pages: write
       id-token: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 81ba031..9b36d3d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   release-please:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6a72e85..32a46cd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
   publish:
     needs: release
     if: ${{ needs.release.outputs.release_created == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       id-token: write
@@ -44,7 +44,7 @@ jobs:
   release-pr-ci:
     needs: release
     if: ${{ needs.release.outputs.pr_branch != '' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: write
     steps:
diff --git a/.github/workflows/repokeeper-check.yml b/.github/workflows/repokeeper-check.yml
index d5625ef..c62f4a6 100644
--- a/.github/workflows/repokeeper-check.yml
+++ b/.github/workflows/repokeeper-check.yml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   check:
     name: repokeeper check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/repokeeper-update.yml b/.github/workflows/repokeeper-update.yml
index f7f0223..00fad40 100644
--- a/.github/workflows/repokeeper-update.yml
+++ b/.github/workflows/repokeeper-update.yml
@@ -29,7 +29,7 @@ permissions:
 jobs:
   update:
     name: repokeeper update
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/stack-dart.yml b/.github/workflows/stack-dart.yml
index 9b51543..55750c9 100644
--- a/.github/workflows/stack-dart.yml
+++ b/.github/workflows/stack-dart.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       flutter:
         description: '"true" to set up Flutter instead of the Dart SDK'
         type: string
diff --git a/.github/workflows/stack-docker.yml b/.github/workflows/stack-docker.yml
index 33049eb..e7231e9 100644
--- a/.github/workflows/stack-docker.yml
+++ b/.github/workflows/stack-docker.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   hadolint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     defaults:
@@ -48,7 +48,7 @@ jobs:
             xargs -0 --no-run-if-empty "$RUNNER_TEMP/hadolint" "${threshold[@]}"
   build:
     if: inputs.build == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     defaults:
diff --git a/.github/workflows/stack-dotnet.yml b/.github/workflows/stack-dotnet.yml
index 57ff4ae..04d0f37 100644
--- a/.github/workflows/stack-dotnet.yml
+++ b/.github/workflows/stack-dotnet.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       commands:
         description: JSON list of shell commands run in order
         type: string
diff --git a/.github/workflows/stack-go.yml b/.github/workflows/stack-go.yml
index 4bc60e8..db01dc4 100644
--- a/.github/workflows/stack-go.yml
+++ b/.github/workflows/stack-go.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       commands:
         description: JSON list of shell commands run in order
         type: string
diff --git a/.github/workflows/stack-java.yml b/.github/workflows/stack-java.yml
index 6a05aa1..460ee03 100644
--- a/.github/workflows/stack-java.yml
+++ b/.github/workflows/stack-java.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       build-tool:
         description: maven or gradle
         type: string
diff --git a/.github/workflows/stack-node.yml b/.github/workflows/stack-node.yml
index d8e3d2c..e156ebd 100644
--- a/.github/workflows/stack-node.yml
+++ b/.github/workflows/stack-node.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       package-manager:
         description: npm, pnpm or yarn
         type: string
diff --git a/.github/workflows/stack-php.yml b/.github/workflows/stack-php.yml
index 3f0fec7..73a8a11 100644
--- a/.github/workflows/stack-php.yml
+++ b/.github/workflows/stack-php.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       install-command:
         description: Command that installs dependencies
         type: string
diff --git a/.github/workflows/stack-python.yml b/.github/workflows/stack-python.yml
index 4b3b33c..4224a78 100644
--- a/.github/workflows/stack-python.yml
+++ b/.github/workflows/stack-python.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       manager:
         description: pip or uv
         type: string
diff --git a/.github/workflows/stack-ruby.yml b/.github/workflows/stack-ruby.yml
index abb44e7..052c8ca 100644
--- a/.github/workflows/stack-ruby.yml
+++ b/.github/workflows/stack-ruby.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       install-command:
         description: Command that installs dependencies
         type: string
diff --git a/.github/workflows/stack-rust.yml b/.github/workflows/stack-rust.yml
index 2fabe7a..e6fc769 100644
--- a/.github/workflows/stack-rust.yml
+++ b/.github/workflows/stack-rust.yml
@@ -10,7 +10,7 @@ on:
       os:
         description: JSON list of runner labels
         type: string
-        default: '["ubuntu-latest"]'
+        default: '["ubuntu-26.04"]'
       commands:
         description: JSON list of shell commands run in order
         type: string
diff --git a/.github/workflows/stack-script.yml b/.github/workflows/stack-script.yml
index f950d7c..acae2c8 100644
--- a/.github/workflows/stack-script.yml
+++ b/.github/workflows/stack-script.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   shell:
     if: inputs.shell-scripts == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     defaults:
@@ -72,7 +72,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-26.04, windows-latest]
     runs-on: ${{ matrix.os }}
     permissions:
       contents: read
diff --git a/.github/workflows/workflow-tests.yml b/.github/workflows/workflow-tests.yml
index ca925e7..e0384b0 100644
--- a/.github/workflows/workflow-tests.yml
+++ b/.github/workflows/workflow-tests.yml
@@ -19,7 +19,7 @@ concurrency:
 # version; the full matrix, Windows included, runs on every push to main.
 jobs:
   changes:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     outputs:
@@ -77,7 +77,7 @@ jobs:
     uses: ./.github/workflows/stack-node.yml
     with:
       working-directory: fixtures/node
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       node-versions: ${{ github.event_name == 'push' && '["22","24"]' || '["24"]' }}
       package-manager: npm
       install-command: npm ci
@@ -89,7 +89,7 @@ jobs:
     uses: ./.github/workflows/stack-node.yml
     with:
       working-directory: fixtures/node-pnpm
-      os: '["ubuntu-latest"]'
+      os: '["ubuntu-26.04"]'
       node-versions: '["24"]'
       package-manager: pnpm
       install-command: pnpm install --frozen-lockfile
@@ -101,7 +101,7 @@ jobs:
     uses: ./.github/workflows/stack-python.yml
     with:
       working-directory: fixtures/python
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       python-versions: ${{ github.event_name == 'push' && '["3.11","3.13"]' || '["3.13"]' }}
       manager: pip
       install-command: python -m pip install -e . && python -m pip install ruff pytest
@@ -112,7 +112,7 @@ jobs:
     uses: ./.github/workflows/stack-dart.yml
     with:
       working-directory: fixtures/dart
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       sdk-versions: '["stable"]'
       flutter: "false"
       install-command: dart pub get
@@ -132,7 +132,7 @@ jobs:
     uses: ./.github/workflows/stack-java.yml
     with:
       working-directory: fixtures/java-maven
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       java-versions: ${{ github.event_name == 'push' && '["17","21"]' || '["21"]' }}
       build-tool: maven
       gradle-version: ""
@@ -143,7 +143,7 @@ jobs:
     uses: ./.github/workflows/stack-java.yml
     with:
       working-directory: fixtures/java-gradle
-      os: '["ubuntu-latest"]'
+      os: '["ubuntu-26.04"]'
       java-versions: '["21"]'
       build-tool: gradle
       gradle-version: current
@@ -154,7 +154,7 @@ jobs:
     uses: ./.github/workflows/stack-dotnet.yml
     with:
       working-directory: fixtures/dotnet
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       dotnet-versions: '["8.0","9.0"]'
       commands: '["dotnet restore","dotnet format --verify-no-changes --no-restore","dotnet build --no-restore","dotnet test --no-build"]'
   go:
@@ -163,7 +163,7 @@ jobs:
     uses: ./.github/workflows/stack-go.yml
     with:
       working-directory: fixtures/go
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       go-versions: '["stable"]'
       commands: '["test -z \"$(gofmt -l .)\" || { gofmt -l .; exit 1; }","go vet ./...","go test ./..."]'
   rust:
@@ -172,7 +172,7 @@ jobs:
     uses: ./.github/workflows/stack-rust.yml
     with:
       working-directory: fixtures/rust
-      os: ${{ github.event_name == 'push' && '["ubuntu-latest","windows-latest"]' || '["ubuntu-latest"]' }}
+      os: ${{ github.event_name == 'push' && '["ubuntu-26.04","windows-latest"]' || '["ubuntu-26.04"]' }}
       rust-versions: '["stable"]'
       commands: '["cargo fmt --all --check","cargo clippy --workspace --all-targets -- -D warnings","cargo test --workspace --all-targets","cargo test --workspace --doc"]'
   kotlin:
@@ -181,7 +181,7 @@ jobs:
     uses: ./.github/workflows/stack-java.yml
     with:
       working-directory: fixtures/kotlin
-      os: '["ubuntu-latest"]'
+      os: '["ubuntu-26.04"]'
       java-versions: '["17"]'
       build-tool: gradle
       gradle-version: current
@@ -192,7 +192,7 @@ jobs:
     uses: ./.github/workflows/stack-php.yml
     with:
       working-directory: fixtures/php
-      os: '["ubuntu-latest"]'
+      os: '["ubuntu-26.04"]'
       php-versions: ${{ github.event_name == 'push' && '["8.3","8.4"]' || '["8.4"]' }}
       install-command: composer install --no-interaction --no-progress
       commands: '["composer validate --no-check-publish","composer test"]'
@@ -202,7 +202,7 @@ jobs:
     uses: ./.github/workflows/stack-ruby.yml
     with:
       working-directory: fixtures/ruby
-      os: '["ubuntu-latest"]'
+      os: '["ubuntu-26.04"]'
       ruby-versions: ${{ github.event_name == 'push' && '["3.3","3.4"]' || '["3.4"]' }}
       install-command: bundle install
       commands: '["bundle exec rake test"]'