diff --git a/.github/workflows/coach-eval.yml b/.github/workflows/coach-eval.yml
index 8b37a5659..e7e4eb6e5 100644
--- a/.github/workflows/coach-eval.yml
+++ b/.github/workflows/coach-eval.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   coach-eval:
     name: Coach eval — deterministic floor (always) + live judge (opt-in)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
 
     # Map the opt-in secret to a job-level env so the live-judge steps can gate
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a14ca324b..0fee025c2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,7 +36,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyse javascript-typescript
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 0323be4c6..99f71e007 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   auto-merge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.actor == 'dependabot[bot]'
     permissions:
       contents: write
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index a34a34c9d..4274e7b3c 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -39,7 +39,7 @@ concurrency:
 jobs:
   release-policy:
     name: Validate release policy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
       actions: read
@@ -121,7 +121,7 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
             cache_scope: amd64
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
@@ -313,7 +313,7 @@ jobs:
   # the registry instead of on one cross-emulated runner.
   merge:
     name: Merge multi-arch manifest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     needs: [build]
     timeout-minutes: 10
@@ -449,7 +449,7 @@ jobs:
   promote:
     name: Promote verified image to Coolify
     needs: [merge, verify-published-image]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 111624651..a3960c33d 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -24,7 +24,7 @@ jobs:
   # mobile route sweep landed, and a slow runner tipped them over; three
   # shards with a 30-minute cap leave room for both.
   shard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -128,7 +128,7 @@ jobs:
   # that name and answers for both shards: it fails when any shard failed or
   # was cancelled, so a half-green matrix cannot satisfy the gate.
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: shard
     if: always()
     timeout-minutes: 5
diff --git a/.github/workflows/env-check.yml b/.github/workflows/env-check.yml
index 11ec45835..a86c42a87 100644
--- a/.github/workflows/env-check.yml
+++ b/.github/workflows/env-check.yml
@@ -21,7 +21,7 @@ permissions:
 jobs:
   env-check:
     name: pnpm check-env against .env.production.example
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: Checkout
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index b75a9d306..9b683d0e0 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -22,7 +22,7 @@ jobs:
   # job timeout only needs to catch a container that never boots. Each shard
   # boots its own Postgres testcontainer.
   shard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -67,7 +67,7 @@ jobs:
   # carries that name and answers for every shard: it fails when any shard
   # failed or was cancelled, so a half-green matrix cannot satisfy the gate.
   integration:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: shard
     if: always()
     timeout-minutes: 5
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index 94d7700e9..8d0e67a25 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   knip:
     name: Dead-code gate
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/no-todo-markers.yml b/.github/workflows/no-todo-markers.yml
index 501c2b7e6..d53f04fca 100644
--- a/.github/workflows/no-todo-markers.yml
+++ b/.github/workflows/no-todo-markers.yml
@@ -16,7 +16,7 @@ jobs:
   # future contributor reintroduces the pattern.
   grep:
     name: Forbidden marker grep
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/post-publish-verify.yml b/.github/workflows/post-publish-verify.yml
index 330be15b5..4f4bdf70f 100644
--- a/.github/workflows/post-publish-verify.yml
+++ b/.github/workflows/post-publish-verify.yml
@@ -45,7 +45,7 @@ permissions:
 jobs:
   verify:
     name: Pull and smoke-test exact published image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     env:
       IMAGE_REF: ${{ inputs.image_ref }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 9fe3950d5..a6c3518ae 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -25,7 +25,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Score supply-chain practices
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       # Write the findings into the repository's code-scanning alerts.
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 5037c89d7..4413b31a8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   quality:
     name: Lint, Typecheck & Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name != 'schedule'
 
     steps:
@@ -100,7 +100,7 @@ jobs:
   # published image daily.
   dependency-audit:
     name: Dependency Audit
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Runs on pull requests too, but advisory: an advisory published against a
     # dependency the branch did not touch must not block the branch. The push
     # run on main and the daily schedule stay blocking, and a tag is only ever
@@ -130,7 +130,7 @@ jobs:
 
   secret-scan:
     name: Secret Scanning
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name != 'schedule'
 
     steps:
@@ -145,7 +145,7 @@ jobs:
 
   docker-security:
     name: Container Security
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 
     steps:
diff --git a/.github/workflows/synthetic-journey.yml b/.github/workflows/synthetic-journey.yml
index 2d096f9b0..268154596 100644
--- a/.github/workflows/synthetic-journey.yml
+++ b/.github/workflows/synthetic-journey.yml
@@ -45,7 +45,7 @@ permissions:
 jobs:
   journey:
     name: Sign in, write a reading, read it back
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
 
     steps:
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 289b57daf..df9949f95 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -30,7 +30,7 @@ concurrency:
 jobs:
   filesystem:
     name: Lockfile (including dev dependencies)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -95,7 +95,7 @@ jobs:
 
   published-image:
     name: Published image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     permissions:
       contents: read