diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 694de24..55fa26e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,8 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    # Pinned to ubuntu-24.04: ubuntu-latest moves to Ubuntu 26 from 2026-10-19. Unpin once 26.04 is verified.
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -53,7 +54,7 @@ jobs:
     # The MCP server against the oldest SDK its pin allows, installed from PyPI, so a tool that
     # needs newer SDK code fails here instead of on a user's machine. A separate job, not an
     # entry in the test matrix: an extra matrix key would rename the required "test (3.x)" checks.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -74,7 +75,7 @@ jobs:
         run: pytest -q packages/embeddedci-mcp
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         package: [embeddedci, embeddedci-mcp, embeddedci-openhtf]
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b9c5aec..50d9906 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -38,7 +38,8 @@ permissions:
 jobs:
   verify:
     name: Check the tag against the package version
-    runs-on: ubuntu-latest
+    # Pinned to ubuntu-24.04: ubuntu-latest moves to Ubuntu 26 from 2026-10-19. Unpin once 26.04 is verified.
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -54,7 +55,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/embeddedci-v')
     name: Publish embeddedci
     needs: [verify, tests]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: pypi
     permissions:
       id-token: write # required for trusted publishing
@@ -80,7 +81,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/embeddedci-py39-shim-v')
     name: Publish embeddedci 0.2.4 (Python 3.9 placeholder)
     needs: [verify, tests]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: pypi
     permissions:
       id-token: write # required for trusted publishing
@@ -103,7 +104,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/embeddedci-mcp-v')
     name: Publish embeddedci-mcp
     needs: [verify, tests]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: pypi-embeddedci-mcp
     permissions:
       id-token: write # required for trusted publishing
@@ -126,7 +127,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/embeddedci-openhtf-v')
     name: Publish embeddedci-openhtf
     needs: [verify, tests]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: pypi-embeddedci-openhtf
     permissions:
       id-token: write # required for trusted publishing
@@ -149,7 +150,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/embeddedci-mcp-v')
     name: Publish embeddedci-mcp to the MCP Registry
     needs: publish-embeddedci-mcp
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       id-token: write # mcp-publisher login github-oidc
       contents: read