diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 63987cc..4985245 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -82,7 +82,7 @@ jobs:
       github-token: ${{ secrets.GITHUB_TOKEN }}
 
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     name: test
     needs:
       - build
diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml
index 026f2e8..4e22ee6 100644
--- a/.github/workflows/standard-build.yaml
+++ b/.github/workflows/standard-build.yaml
@@ -98,7 +98,7 @@ on:
 jobs:
   build:
     name: build image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write
@@ -353,7 +353,7 @@ jobs:
 
   sign-image:
     name: sign image
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' }}
     needs:
       - build
@@ -386,7 +386,7 @@ jobs:
 
   attest-trivy-vulnerability-report:
     name: attest trivy vulnerability report
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' && inputs.enable-trivy-scan }}
     needs:
       - build
@@ -425,7 +425,7 @@ jobs:
 
   upload-attestion-to-release:
     name: upload slsa attestations to release assets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ startsWith(github.ref, 'refs/tags/') }}
     needs:
       - image-provenance
@@ -457,7 +457,7 @@ jobs:
 
   upload-sbom-to-release:
     name: upload image SBOMs to release assets
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build
     permissions:
diff --git a/.github/workflows/standard-lint.yaml b/.github/workflows/standard-lint.yaml
index c1a7b78..7862cba 100644
--- a/.github/workflows/standard-lint.yaml
+++ b/.github/workflows/standard-lint.yaml
@@ -62,7 +62,7 @@ on:
 jobs:
   megalinter:
     name: MegaLinter
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name == 'pull_request' }}
     permissions:
       issues: write
@@ -126,7 +126,7 @@ jobs:
 
   dependency-review:
     name: dependency review
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # can only run on PRs or the error is:
     # "Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` config options, or by running a `pull_request`/`pull_request_target` workflow."
     if: ${{ github.event_name == 'pull_request' }}
@@ -142,7 +142,7 @@ jobs:
 
   gradle-wrapper-validation:
     name: validate gradle wrapper
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-validate-gradle-wrapper }}
     permissions:
       contents: read
@@ -156,7 +156,7 @@ jobs:
 
   base-image-signature-verification:
     name: verify Dockerfile base image signature
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-verify-base-image-signature }}
     permissions:
       contents: read
@@ -181,7 +181,7 @@ jobs:
 
   codeql-analyze:
     name: CodeQL analyze
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ inputs.enable-codeql }}
     permissions:
       actions: read
diff --git a/.github/workflows/standard-release.yaml b/.github/workflows/standard-release.yaml
index 2dec011..eaf4e27 100644
--- a/.github/workflows/standard-release.yaml
+++ b/.github/workflows/standard-release.yaml
@@ -28,7 +28,7 @@ on:
 jobs:
   release:
     name: release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     # run only on pushes. The semantic release default config allows releases
     # to only be created from the default branch ('master'). The ci.yaml
     # is configured to only run on pushes to master as well.