diff --git a/.github/workflows/api-compat-noop.yml b/.github/workflows/api-compat-noop.yml
index 1aefbaa5c3..88391f0364 100644
--- a/.github/workflows/api-compat-noop.yml
+++ b/.github/workflows/api-compat-noop.yml
@@ -36,7 +36,7 @@ permissions:
 jobs:
   crd-schema-check:
     name: CRD Schema Compatibility
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 2
     steps:
       - name: No API surface changes
diff --git a/.github/workflows/api-compat.yml b/.github/workflows/api-compat.yml
index b44ac41762..7b5e08d524 100644
--- a/.github/workflows/api-compat.yml
+++ b/.github/workflows/api-compat.yml
@@ -44,7 +44,7 @@ permissions:
 jobs:
   crd-schema-check:
     name: CRD Schema Compatibility
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # Skip the check entirely when `api-break-allowed` is applied — a
     # required check that is skipped (rather than failed) counts as passing
     # for branch protection, so this is the escape hatch for intentional
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index b52052b3a2..da31d258a0 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -57,7 +57,7 @@ jobs:
             label_filter: core
             artifact: e2e-test-results-core
             procs: 4
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: mcp-run
             label_filter: mcp-run
             artifact: e2e-test-results-mcp-run
@@ -77,12 +77,12 @@ jobs:
           - title: api-registry
             label_filter: api-registry
             artifact: e2e-test-results-api-registry
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-workloads
             label_filter: "api-workloads && !lifecycle"
             artifact: e2e-test-results-api-workloads
             test_timeout: 25m
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-workloads-lifecycle
             label_filter: "api-workloads && lifecycle"
             artifact: e2e-test-results-api-workloads-lifecycle
@@ -90,18 +90,18 @@ jobs:
           - title: api-clients
             label_filter: api-clients
             artifact: e2e-test-results-api-clients
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: api-misc
             label_filter: api-misc
             artifact: e2e-test-results-api-misc
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
           - title: vmcp
             label_filter: vmcp
             artifact: e2e-test-results-vmcp
           - title: llm
             label_filter: llm
             artifact: e2e-test-results-llm
-            runner: ubuntu-latest
+            runner: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -208,7 +208,7 @@ jobs:
   conformance:
     name: MCP Conformance
     # Runs for about a minute; the standard runner is free for this public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: build-binary
     timeout-minutes: 20
     strategy:
diff --git a/.github/workflows/license-headers.yml b/.github/workflows/license-headers.yml
index bcf0c76b7f..7ea8334b56 100644
--- a/.github/workflows/license-headers.yml
+++ b/.github/workflows/license-headers.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   check-license-headers:
     name: Check License Headers
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5884f520c8..aa5ea1cb59 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,7 +12,7 @@ jobs:
     # golangci-lint itself runs for well under a minute here; the job is
     # dominated by checkout, toolchain setup and cache restore, none of which
     # scale with cores. The standard runner is free for this public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/.github/workflows/operator-ci.yml b/.github/workflows/operator-ci.yml
index b019c16496..4f2fee10b4 100644
--- a/.github/workflows/operator-ci.yml
+++ b/.github/workflows/operator-ci.yml
@@ -12,7 +12,7 @@ jobs:
     name: Operator Tests
     # Short, setup-dominated job; the standard runner is free for this
     # public repo. Integration and E2E jobs below keep the large runner.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -60,7 +60,7 @@ jobs:
     name: Build Operator
     # Short, setup-dominated job; the standard runner is free for this
     # public repo.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -83,7 +83,7 @@ jobs:
 
   generate-crds:
     name: Generate CRDs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -118,7 +118,7 @@ jobs:
 
   generate-crd-docs:
     name: Generate CRD Docs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index d21bc246d7..c21f23a544 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   grype-repo-scan:
     name: Grype Repository Scan
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write
@@ -53,7 +53,7 @@ jobs:
 
   zizmor:
     name: GitHub Actions Static Analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       security-events: write
@@ -98,7 +98,7 @@ jobs:
 
   govulncheck:
     name: Go Vulnerability Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
diff --git a/.github/workflows/skills-build.yml b/.github/workflows/skills-build.yml
index 7c1c483ba2..6f35b29014 100644
--- a/.github/workflows/skills-build.yml
+++ b/.github/workflows/skills-build.yml
@@ -35,7 +35,7 @@ on:
 jobs:
   skills-build:
     name: Build Skills
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
 
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index 125009ce50..ddd9fb7d37 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   codespell:
     name: Codespell
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -20,4 +20,4 @@ jobs:
         with:
           skip: .git
           check_filenames: true
-          check_hidden: true
\ No newline at end of file
+          check_hidden: true
diff --git a/.github/workflows/verify-gen.yml b/.github/workflows/verify-gen.yml
index 8ca30e9177..5d93f11df8 100644
--- a/.github/workflows/verify-gen.yml
+++ b/.github/workflows/verify-gen.yml
@@ -9,7 +9,7 @@ permissions:
 jobs:
   verify-code-generation:
     name: Verify Code Generation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7