diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml
index 9f553534c..fdeae0ae7 100644
--- a/.github/workflows/binary_provenance.yml
+++ b/.github/workflows/binary_provenance.yml
@@ -24,7 +24,7 @@ on:
 
 jobs:
     binary-provenance:
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-26.04
         permissions:
             id-token: write
             contents: write
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 07147455a..801d79907 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   review-dependency-updates:
     if: contains(fromJSON('["dependabot[bot]", "ci-signed-commit-bot[bot]"]'), github.actor)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -72,7 +72,7 @@ jobs:
   review-general:
     # Skip for Dependabot|CI bot PRs
     if: ${{ !contains(fromJSON('["dependabot[bot]", "ci-signed-commit-bot[bot]"]'), github.actor) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       id-token: write
diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml
index b193777d0..66b632d32 100644
--- a/.github/workflows/daily-cli-tests.yml
+++ b/.github/workflows/daily-cli-tests.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   set-trail-name:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       trail_name: ${{ steps.prep.outputs.trail_name }}
     steps:
@@ -56,7 +56,7 @@ jobs:
 
   contract-tests:
     name: Contract Tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: read
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 95eb26afe..e4dbbdd1d 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -59,7 +59,7 @@ jobs:
   # ---------------------------------------------------------------------------
   prepare:
     name: Prepare build matrix
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.set-version.outputs.version }}
@@ -75,7 +75,7 @@ jobs:
           PLATFORMS: ${{ inputs.platforms }}
           RUNNER_MAP: |
             {
-              "linux/amd64": "ubuntu-latest",
+              "linux/amd64": "ubuntu-26.04",
               "linux/arm64": "ubuntu-24.04-arm"
             }
         run: |
@@ -197,7 +197,7 @@ jobs:
   # ---------------------------------------------------------------------------
   merge:
     name: Docker Merge & Attest
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     needs: [prepare, build]
     permissions:
       id-token: write
diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml
index cc9852c5d..4e71b50d6 100644
--- a/.github/workflows/helm-chart.yml
+++ b/.github/workflows/helm-chart.yml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/init_kosli.yml b/.github/workflows/init_kosli.yml
index 5ec59c752..1c1a78571 100644
--- a/.github/workflows/init_kosli.yml
+++ b/.github/workflows/init_kosli.yml
@@ -32,7 +32,7 @@ on:
 jobs:
     init-kosli:
         name: Init Kosli
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-26.04
         permissions:
             id-token: write
             contents: write
diff --git a/.github/workflows/install-script-tests.yml b/.github/workflows/install-script-tests.yml
index b80805fc5..254103463 100644
--- a/.github/workflows/install-script-tests.yml
+++ b/.github/workflows/install-script-tests.yml
@@ -29,7 +29,7 @@ jobs:
         runs-on: ${{ matrix.os }}
         strategy:
             matrix:
-                os: [ubuntu-latest, macos-latest, windows-latest]
+                os: [ubuntu-26.04, macos-latest, windows-latest]
 
         steps:
         - name: Harden Runner
@@ -82,7 +82,7 @@ jobs:
         strategy:
             matrix:
                 os:
-                    - ubuntu-latest        # linux/x64
+                    - ubuntu-26.04        # linux/x64
                     - ubuntu-24.04-arm     # linux/arm64
                     - macos-latest         # darwin/arm64
                     - windows-latest       # win32/x64
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1d3cd170d..b838d80aa 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   pre-build:
     if: github.event_name == 'push' || github.actor == 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       tag: ${{ steps.prep.outputs.tag }}
       trail_name: ${{ steps.prep.outputs.trail_name }}
diff --git a/.github/workflows/never_alone_trail.yml b/.github/workflows/never_alone_trail.yml
index fd0e74985..13bef5c05 100644
--- a/.github/workflows/never_alone_trail.yml
+++ b/.github/workflows/never_alone_trail.yml
@@ -33,7 +33,7 @@ on:
 jobs:
     never-alone-trail:
         name: Never Alone Trail
-        runs-on: ubuntu-latest
+        runs-on: ubuntu-26.04
         permissions:
             id-token: write
             contents: write
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index fadffc69a..8e61ac755 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -18,7 +18,7 @@ jobs:
     # Run only when the PR comes from the same repository, not from a fork
     #if: github.event.pull_request.head.repo.full_name == github.repository
     name: Validate PR
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -37,7 +37,7 @@ jobs:
     # Run only when the PR comes from the same repository, not from a fork
     #if: github.event.pull_request.head.repo.full_name == github.repository
     name: Label PRs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa8ccb887..4bc11f289 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,7 +10,7 @@ concurrency:
 
 jobs:
   notify-start:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -24,7 +24,7 @@ jobs:
           stage: start
 
   pre-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
       trail_name: ${{ steps.prep.outputs.trail_name }}
@@ -131,7 +131,7 @@ jobs:
 
   goreleaser:
     needs: [test]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
       id-token: write
@@ -252,7 +252,7 @@ jobs:
 
   docs-repo-dispatch:
     needs: [pre-build, goreleaser]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -269,7 +269,7 @@ jobs:
 
   evidence-reporter-upload-package-and-deploy:
     needs: [pre-build, goreleaser, environment-reporter-upload-layer]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -286,7 +286,7 @@ jobs:
 
   environment-reporter-upload-package-and-deploy:
     needs: [pre-build, goreleaser, environment-reporter-upload-layer]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -326,7 +326,7 @@ jobs:
         environment-reporter-upload-layer
       ]
     if: always() && needs.notify-start.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: read     # ← needed to fetch run_started_at for duration
       contents: read    # ← needed to read release notes via `gh release view`
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c51dd6c79..fa5300780 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -71,7 +71,7 @@ jobs:
   lint:
     if: ${{ inputs.run_lint }}
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: write
@@ -120,7 +120,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: write
@@ -196,7 +196,7 @@ jobs:
   snyk-code-test:
     if: ${{ inputs.run_snyk }}
     name: Snyk Code Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: write
@@ -250,7 +250,7 @@ jobs:
   snyk-dependency-test:
     if: ${{ inputs.run_snyk }}
     name: Snyk Dependency Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write
       contents: write