diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0c20ff88..5ea2c3f6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
   # below explicitly opt manual runs back into running everything.
   changes:
     name: Detect Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       builds: ${{ steps.filter.outputs.builds }}
       tests:  ${{ steps.filter.outputs.tests }}
@@ -145,7 +145,7 @@ jobs:
   # This job is an aggregate job
   ci:
     name: CI
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # List all the jobs that need to succeed for the CI to pass
     needs:
       - changes
diff --git a/.github/workflows/cpp-tools.yml b/.github/workflows/cpp-tools.yml
index f0663f78..d48474a8 100644
--- a/.github/workflows/cpp-tools.yml
+++ b/.github/workflows/cpp-tools.yml
@@ -11,7 +11,7 @@ permissions:
 jobs:
   clang-format:
     name: clang-format
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: false
     timeout-minutes: 15
 
@@ -52,7 +52,7 @@ jobs:
 
   clang-tidy:
     name: clang-tidy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     continue-on-error: false
     timeout-minutes: 45
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index c3cbc824..0f6653fb 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -58,7 +58,7 @@ jobs:
   build:
     name: Generate and verify docs
     if: github.event_name == 'release' || inputs.build_docs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       project_number: ${{ steps.build_docs.outputs.project_number }}
       artifact_name: ${{ steps.artifact_meta.outputs.name }}
@@ -168,7 +168,7 @@ jobs:
     # CI enables this only for trusted main pushes. Release events always
     # check credentials before publishing. PR jobs never receive deploy keys.
     if: github.event_name == 'release' || inputs.check_credentials
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Verify docs deploy credentials
         env:
@@ -187,7 +187,7 @@ jobs:
     name: Publish (S3 + CloudFront)
     needs: [build, credentials]
     if: github.event_name == 'release' && github.event.release.prerelease == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Download docs artifact
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
diff --git a/.github/workflows/license_check.yml b/.github/workflows/license_check.yml
index ee1c05ff..ed22fed8 100644
--- a/.github/workflows/license_check.yml
+++ b/.github/workflows/license_check.yml
@@ -6,7 +6,7 @@ on:
 jobs:
   license-check:
     name: License Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/link_check.yml b/.github/workflows/link_check.yml
index c4740ce5..4586929d 100644
--- a/.github/workflows/link_check.yml
+++ b/.github/workflows/link_check.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   check-links:
     name: Link Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index ca085dd9..90d6b3fe 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -348,7 +348,7 @@ jobs:
   # ---------- Release Job ----------
   release:
     name: Create GitHub Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs:
       - build
     permissions:
diff --git a/.github/workflows/rust-release-check.yml b/.github/workflows/rust-release-check.yml
index c9f096ac..7f06564d 100644
--- a/.github/workflows/rust-release-check.yml
+++ b/.github/workflows/rust-release-check.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   rust-release-check:
     name: Rust Release Check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout (with submodules)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index efeaf448..c020db34 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -472,7 +472,7 @@ jobs:
   coverage:
     name: Code Coverage
     if: inputs.run_coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A debug build instrumented with --coverage is far heavier (RAM + disk)
     # than the release builds. Cap the wall-clock so a stuck/OOM build fails
     # fast and visibly instead of hanging toward the 6h default.