diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dcfff95..0e75a71 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
   # repository-wide checks (dependency review, secret scan, REUSE) always run.
   changes:
     name: Detect changed paths
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       site: ${{ steps.paths.outputs.site }}
@@ -43,7 +43,7 @@ jobs:
     # bench/ changed. If the path check itself fails, run anyway rather than
     # skip a required check.
     if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.site == 'true') }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -183,7 +183,7 @@ jobs:
     name: Dependency audit (non-blocking)
     needs: changes
     if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.site == 'true') }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -240,7 +240,7 @@ jobs:
   # block merge and stays with `bun audit` and CLAUDE.md "Audit advisories".
   dependency-review:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       # Implies read, which the guard uses to list a fork's changed files.
@@ -329,7 +329,7 @@ jobs:
   # after the secret was committed, or push-protection bypass via the
   # "I'll fix it later" allow path).
   secret-scan:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
     steps:
@@ -357,7 +357,7 @@ jobs:
   # persist the read-only token into the workspace the container mounts.
   reuse:
     name: REUSE compliance
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 252ff88..f95a584 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -35,7 +35,7 @@ jobs:
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     permissions:
       contents: write
diff --git a/.github/workflows/dependency-snapshot.yml b/.github/workflows/dependency-snapshot.yml
index 4d0686a..a2bc5f5 100644
--- a/.github/workflows/dependency-snapshot.yml
+++ b/.github/workflows/dependency-snapshot.yml
@@ -34,7 +34,7 @@ jobs:
     # for this job by its name and fails unless it succeeded, so rename both
     # together.
     if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       # The submission API wants `contents: write`; nothing else.
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
index 3b51d83..208f63d 100644
--- a/.github/workflows/lighthouse.yml
+++ b/.github/workflows/lighthouse.yml
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   changes:
     name: Detect changed paths
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       site: ${{ steps.paths.outputs.site }}
@@ -40,7 +40,7 @@ jobs:
     # passing, when nothing outside bench/ changed. If the path check itself
     # fails, run anyway rather than skip.
     if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.site == 'true') }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 865ed9e..be5a8cb 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -45,7 +45,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       # Needed by github/codeql-action/upload-sarif to write Security tab
       # entries.