diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index 7896506..14bdf05 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -30,7 +30,7 @@ jobs:
   # `paths` on the trigger leaves a required check unreported for good; a skipped job counts as met.
   changes:
     name: what the branch touched
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
       packaging: ${{ steps.look.outputs.packaging }}
diff --git a/.github/workflows/caches.yml b/.github/workflows/caches.yml
index 76da440..c9100ac 100644
--- a/.github/workflows/caches.yml
+++ b/.github/workflows/caches.yml
@@ -21,7 +21,7 @@ jobs:
   sweep:
     name: a closed pull request takes its caches with it
     if: github.event_name == 'pull_request_target'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       actions: write
@@ -42,7 +42,7 @@ jobs:
       && github.event.workflow_run.head_branch == 'main'
       && github.event.workflow_run.head_repository.full_name == github.repository
       && github.event.workflow_run.conclusion != 'cancelled')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       actions: write
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f13fa32..71a9f25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
 
   lint:
     name: fmt
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -63,7 +63,7 @@ jobs:
 
   picker:
     name: frontend
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     defaults:
       run:
@@ -83,7 +83,7 @@ jobs:
 
   prose:
     name: markdown
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -99,7 +99,7 @@ jobs:
 
   audit:
     name: advisories + licences
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -130,7 +130,7 @@ jobs:
 
   coverage:
     name: coverage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 40
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -213,7 +213,7 @@ jobs:
   sonar:
     name: sonarcloud
     needs: [coverage, coverage-mac]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     if: >-
       github.actor != 'dependabot[bot]'
diff --git a/.github/workflows/commits.yml b/.github/workflows/commits.yml
index a10a801..0a9e1fb 100644
--- a/.github/workflows/commits.yml
+++ b/.github/workflows/commits.yml
@@ -16,7 +16,7 @@ jobs:
   retitle:
     name: A title Dependabot wrote, cut to fit
     if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
       pull-requests: write
@@ -45,7 +45,7 @@ jobs:
     needs: retitle
     # Skipped for everyone but Dependabot, and a failed cut leaves the long title to fail below.
     if: ${{ !cancelled() }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/feed.yml b/.github/workflows/feed.yml
index fe70820..6b53615 100644
--- a/.github/workflows/feed.yml
+++ b/.github/workflows/feed.yml
@@ -17,7 +17,7 @@ permissions:
 jobs:
   answers:
     name: the feed answers what a copy would read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/mutants-sweep.yml b/.github/workflows/mutants-sweep.yml
index 93fdf2e..ae21c4d 100644
--- a/.github/workflows/mutants-sweep.yml
+++ b/.github/workflows/mutants-sweep.yml
@@ -19,7 +19,7 @@ env:
 jobs:
   core:
     name: core / every mutant
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -57,7 +57,7 @@ jobs:
 
   shell:
     name: shell / shard ${{ matrix.shard }} of 4
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 330
     strategy:
       fail-fast: false
@@ -105,7 +105,7 @@ jobs:
 
   settings:
     name: settings / shard ${{ matrix.shard }} of 2
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 330
     strategy:
       fail-fast: false
@@ -217,7 +217,7 @@ jobs:
 
   window:
     name: window / shard ${{ matrix.shard }} of 4
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 180
     strategy:
       fail-fast: false
@@ -274,7 +274,7 @@ jobs:
     # A dispatch from another branch would write its numbers into the score main is read by.
     if: always() && !cancelled() && github.ref == 'refs/heads/main'
     needs: [core, shell, settings, mac, window]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
       contents: write
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index 2657d09..1d8ba5d 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -17,7 +17,7 @@ jobs:
   # `paths` on the trigger leaves a required check unreported for good; a skipped job counts as met.
   changes:
     name: what the branch touched
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
       mutable: ${{ steps.look.outputs.mutable }}
@@ -41,7 +41,7 @@ jobs:
 
   crates-on-the-branch:
     name: crates / the lines this branch changed
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: changes
     if: github.actor != 'dependabot[bot]' && needs.changes.outputs.mutable == 'true'
     timeout-minutes: 90
@@ -159,7 +159,7 @@ jobs:
 
   settings-on-the-branch:
     name: settings / the lines this branch changed
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: changes
     if: github.actor != 'dependabot[bot]' && needs.changes.outputs.mutable == 'true'
     timeout-minutes: 90
@@ -225,7 +225,7 @@ jobs:
 
   window-on-the-branch:
     name: window / the lines this branch changed
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: changes
     if: github.actor != 'dependabot[bot]' && needs.changes.outputs.mutable == 'true'
     timeout-minutes: 60
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c8801fc..15691ab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ env:
 jobs:
   gate:
     name: Style and prose
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -54,7 +54,7 @@ jobs:
 
   tested:
     name: Tested when it landed
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Past the longest chain CI can take: coverage's forty minutes, then Sonar's fifteen.
     timeout-minutes: 65
     permissions:
@@ -103,7 +103,7 @@ jobs:
   version:
     name: Resolve the version
     needs: [gate]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
       version: ${{ steps.resolve.outputs.version }}
@@ -810,7 +810,7 @@ jobs:
       && needs.bundle-windows.result == 'success'
       && (needs.bundle-macos.result == 'success' || needs.bundle-macos.result == 'skipped')
       && (needs.bundle-msix.result == 'success' || needs.bundle-msix.result == 'skipped')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     # Global: one manifest branch and one Latest flag; a third tag cancels the waiting one, re-run it by hand.
     concurrency:
@@ -1103,7 +1103,7 @@ jobs:
     if: >-
       !cancelled() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
       && needs.version.result == 'success' && needs.publish.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -1289,7 +1289,7 @@ jobs:
       && needs.version.result == 'success' && needs.publish.result == 'success'
       && needs.verify.result == 'success'
       && needs.version.outputs.macos == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     # Per tag: a global group cancels a pending tag, and the push loop already rebases over another.
     concurrency:
@@ -1428,7 +1428,7 @@ jobs:
       && needs.verify.result == 'success'
       && needs.version.outputs.prerelease == 'false'
       && vars.WINGET_PUBLISH == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     concurrency:
       group: release-winget-${{ github.ref }}
diff --git a/.github/workflows/rules.yml b/.github/workflows/rules.yml
index a4371af..a4997fd 100644
--- a/.github/workflows/rules.yml
+++ b/.github/workflows/rules.yml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   conventions:
     name: Project conventions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -81,7 +81,7 @@ jobs:
   determinism:
     name: Tests are deterministic
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,7 +103,7 @@ jobs:
   notices:
     name: The notices name what ships
     if: github.event_name != 'push'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/update-badge.yml b/.github/workflows/update-badge.yml
index 0a39137..5735689 100644
--- a/.github/workflows/update-badge.yml
+++ b/.github/workflows/update-badge.yml
@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   update-badge:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1