diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68b70064..4e3a676c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,7 +39,7 @@ jobs:
     name: Version tables in sync with manifest
     # Tags only publish; tests run on branches/PRs before the tag is cut.
     if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -253,7 +253,7 @@ jobs:
   bridge_example_android:
     name: Test Bridge example on Android (Python ${{ matrix.python_version }})
     if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -639,7 +639,7 @@ jobs:
     name: Publish GitHub Release
     needs:
       - publish
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ !cancelled() && needs.publish.result == 'success' && startsWith(github.ref, 'refs/tags/v') }}
     permissions:
       contents: write
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e9ba32c0..c8ffd438 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   zizmor:
     name: Run zizmor
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       security-events: write
       contents: read