diff --git a/.github/workflows/itf-examples.yml b/.github/workflows/itf-examples.yml
index f470a425..22833b2e 100644
--- a/.github/workflows/itf-examples.yml
+++ b/.github/workflows/itf-examples.yml
@@ -17,7 +17,7 @@ on:
     types: [checks_requested]
 jobs:
   itf-examples-build-all:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: ./examples
diff --git a/.github/workflows/itf-qnx.yml b/.github/workflows/itf-qnx.yml
index 1cc05559..e60f42e8 100644
--- a/.github/workflows/itf-qnx.yml
+++ b/.github/workflows/itf-qnx.yml
@@ -18,7 +18,7 @@ on:
 jobs:
   workflow-approval:
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     environment: workflow-approval
     steps:
       - run: echo "Workflow approved"
@@ -26,7 +26,7 @@ jobs:
     needs: workflow-approval
     # yamlfmt inserts spurious blank lines in >- blocks, so keep this on one line
     if: ${{ !cancelled() && (needs.workflow-approval.result == 'success' || needs.workflow-approval.result == 'skipped') && (github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository) }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: read
diff --git a/.github/workflows/itf.yml b/.github/workflows/itf.yml
index e0ee1c38..6010a7a3 100644
--- a/.github/workflows/itf.yml
+++ b/.github/workflows/itf.yml
@@ -17,7 +17,7 @@ on:
     types: [checks_requested]
 jobs:
   itf-build-all:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -33,7 +33,7 @@ jobs:
           bazel test //...
 
   itf-qemu-linux:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7