diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c18985..984888c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
 
@@ -63,7 +63,7 @@ jobs:
   # only), then boot it under Bun and read the pages that come off disk at
   # request time or go through the crawl-gateway middleware.
   web-bun:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -110,7 +110,7 @@ jobs:
           cat /tmp/web.log
 
   integration:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/deploy-dev2.yml b/.github/workflows/deploy-dev2.yml
index bb051b2..e995eec 100644
--- a/.github/workflows/deploy-dev2.yml
+++ b/.github/workflows/deploy-dev2.yml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       # ${{ }} values go through env, never straight into a run: body.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16ee927..6a25211 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   linux:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
 
diff --git a/.github/workflows/threatcrush.yml b/.github/workflows/threatcrush.yml
index 39aa922..bd85eea 100644
--- a/.github/workflows/threatcrush.yml
+++ b/.github/workflows/threatcrush.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4