diff --git a/.github/workflows/build-fedora-packages.yml b/.github/workflows/build-fedora-packages.yml
index 0a95d181f8ab77..4f9ec1c99449ad 100644
--- a/.github/workflows/build-fedora-packages.yml
+++ b/.github/workflows/build-fedora-packages.yml
@@ -37,7 +37,9 @@ env:
 jobs:
   build:
     name: Build Fedora RPM packages
-    runs-on: ubuntu-latest
+    # Pin 24.04: sha512hmac (libkcapi) uses host AF_ALG; ubuntu-latest
+    # (26.04) fails with "Allocation of hmac(sha512) cipher failed".
+    runs-on: ubuntu-24.04
     timeout-minutes: 330
     container:
       image: docker.io/library/fedora:43
diff --git a/.github/workflows/sync-linux-next.yml b/.github/workflows/sync-linux-next.yml
index 7b10d59a7b0c29..c36aa57b9493b1 100644
--- a/.github/workflows/sync-linux-next.yml
+++ b/.github/workflows/sync-linux-next.yml
@@ -56,6 +56,9 @@ jobs:
 
       - name: Configure upstream
         run: |
+          # Checkout runs as a different UID than the Arch container user, so
+          # git refuses the tree as "dubious ownership" unless we mark it safe.
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
           git remote remove upstream || true
           git remote add upstream https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
           git fetch --no-tags upstream --prune