diff --git a/.github/workflows/cancel_closed_pr_runs.yml b/.github/workflows/cancel_closed_pr_runs.yml
index 93d65312d..91005de52 100644
--- a/.github/workflows/cancel_closed_pr_runs.yml
+++ b/.github/workflows/cancel_closed_pr_runs.yml
@@ -24,7 +24,7 @@ jobs:
     permissions:
       actions: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/check_amalgamation.yml b/.github/workflows/check_amalgamation.yml
index 66af126fa..253531e40 100644
--- a/.github/workflows/check_amalgamation.yml
+++ b/.github/workflows/check_amalgamation.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   save:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
diff --git a/.github/workflows/check_docs_links.yml b/.github/workflows/check_docs_links.yml
index 12f5ad074..f7e28ab69 100644
--- a/.github/workflows/check_docs_links.yml
+++ b/.github/workflows/check_docs_links.yml
@@ -16,7 +16,7 @@ concurrency:
 jobs:
   check_docs_links:
     if: github.repository == 'nlohmann/json'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/comment_check_amalgamation.yml b/.github/workflows/comment_check_amalgamation.yml
index 04bfaae88..ba2fcad7b 100644
--- a/.github/workflows/comment_check_amalgamation.yml
+++ b/.github/workflows/comment_check_amalgamation.yml
@@ -12,7 +12,7 @@ jobs:
   comment:
     # push runs on develop have no PR to comment on (and no "pr" artifact)
     if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       actions: read
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index bd2d295a4..27c229572 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
diff --git a/.github/workflows/flawfinder.yml b/.github/workflows/flawfinder.yml
index b3e2511ae..ffc8c2a43 100644
--- a/.github/workflows/flawfinder.yml
+++ b/.github/workflows/flawfinder.yml
@@ -24,7 +24,7 @@ on:
 jobs:
   flawfinder:
     name: Flawfinder
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 35549b4e0..85c7a513d 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
       pull-requests: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/publish_documentation.yml b/.github/workflows/publish_documentation.yml
index 12c55a0d4..ad53308d7 100644
--- a/.github/workflows/publish_documentation.yml
+++ b/.github/workflows/publish_documentation.yml
@@ -34,7 +34,7 @@ jobs:
       contents: write
 
     if: github.repository == 'nlohmann/json'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 14b987200..62e1d504a 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 41928ab20..da7d91fce 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   stale:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     permissions:
       issues: write
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index a8cd05766..c93c0a706 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   ci_test_gcc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: gcc:latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -130,7 +130,7 @@ jobs:
         run: cmake --build build --target ${{ matrix.target }}
 
   ci_static_analysis_clang:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: silkeh/clang:22
     strategy:
       matrix:
@@ -149,7 +149,7 @@ jobs:
         run: cmake --build build --target ${{ matrix.target }}
 
   ci_cmake_options:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: ubuntu:24.04
     strategy:
       matrix:
@@ -209,7 +209,7 @@ jobs:
           fail-on-error: false
 
   ci_test_compilers_gcc_old:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         compiler: ['4.8', '4.9', '5', '6']
@@ -251,7 +251,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_g++-${{ matrix.compiler }}
 
   ci_test_compilers_gcc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         # older GCC docker images (4, 5, 6) fail to check out code
@@ -269,7 +269,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_default
 
   ci_test_compilers_clang:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', '21', '22', 'latest']
@@ -289,7 +289,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_default
 
   ci_test_standards_gcc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: gcc:latest
     strategy:
       matrix:
@@ -306,7 +306,7 @@ jobs:
         run: cmake --build build --target ci_test_gcc_cxx${{ matrix.standard }}
 
   ci_test_standards_clang:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: silkeh/clang:latest
     strategy:
       matrix:
@@ -330,7 +330,7 @@ jobs:
         if: ${{ matrix.stdlib == 'libstdcxx' }}
 
   ci_cuda_example:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -356,7 +356,7 @@ jobs:
     strategy:
       matrix:
         container: ['gcc:latest', 'silkeh/clang:latest']
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: ${{ matrix.container }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -383,7 +383,7 @@ jobs:
         run: cmake --build build --target ci_module_cpp20
 
   ci_icpc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     # Intel discontinued the classic icc/icpc compiler in oneAPI 2024.0; this is
     # Intel's own last officially published image that still includes it.
     container: intel/oneapi-hpckit:2023.2.1-devel-ubuntu22.04
@@ -402,7 +402,7 @@ jobs:
         run: cmake --build build --target ci_icpc
 
   ci_icpx:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: intel/oneapi-hpckit:latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -416,7 +416,7 @@ jobs:
         run: cmake --build build --target ci_icpx
 
   ci_nvhpc:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     container: nvcr.io/nvidia/nvhpc:25.5-devel-cuda12.9-ubuntu22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1