diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f24e3dda..c3233d5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ on:
 jobs:
   build:
     name: "build (py${{ matrix.python-version }})"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: true
       matrix:
@@ -138,7 +138,7 @@ jobs:
   e2e-self-serve:
     name: e2e-self-serve
     needs: [build]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout
         uses: actions/checkout@v5
diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
index f30069e9..79b1d942 100644
--- a/.github/workflows/publish-images.yml
+++ b/.github/workflows/publish-images.yml
@@ -27,7 +27,7 @@ env:
 
 jobs:
   authorize-release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     environment: release-images
     permissions:
       contents: read
@@ -90,7 +90,7 @@ jobs:
           PY
 
   reuse-release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     needs: [authorize-release]
     environment: release-images
     permissions:
@@ -182,7 +182,7 @@ jobs:
           if-no-files-found: error
 
   build-candidate-images:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     needs: [authorize-release, reuse-release]
     if: needs.reuse-release.outputs.reuse != 'true'
     environment: release-images
@@ -467,7 +467,7 @@ jobs:
           if-no-files-found: error
 
   cleanup-unpromoted-candidates:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     needs: [authorize-release, reuse-release, build-candidate-images]
     if: >-
       always() &&
@@ -554,7 +554,7 @@ jobs:
           if-no-files-found: error
 
   promote-images:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     needs: [build-candidate-images, authorize-release, reuse-release]
     if: needs.reuse-release.outputs.reuse != 'true'
     environment: release-images
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4357e7b3..da71c0d4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -11,7 +11,7 @@ env:
 
 jobs:
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     strategy:
@@ -34,7 +34,7 @@ jobs:
   # Zero-cost wiring coverage remains a normal release prerequisite, but its
   # e2e-stub producer can never create the retained release evidence below.
   e2e-self-serve:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -61,7 +61,7 @@ jobs:
     if: >-
       vars.CODEPROBE_RELEASE_AGENT_IMAGE != ''
       && vars.CODEPROBE_RELEASE_SCORING_IMAGE != ''
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     environment: release-real-agent
     permissions:
@@ -123,7 +123,7 @@ jobs:
       && needs.e2e-self-serve.result == 'success'
       && needs.e2e-enterprise.result != 'failure'
       && needs.e2e-enterprise.result != 'cancelled'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     env:
@@ -210,7 +210,7 @@ jobs:
     # 31136068209 passed every gate and shipped nothing. Assert gate's real
     # result instead, so a skipped or failed gate still cannot publish.
     if: always() && needs.gate.result == 'success'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps: