diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..978712b
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - ubuntu-26.04
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b932cd2..2af73eb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   quality:
     name: Fast repository checks
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -52,7 +52,7 @@ jobs:
     name: required
     if: always()
     needs: [quality, windows-fast]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e86e756..b54b1ab 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -15,11 +15,12 @@ concurrency:
 
 jobs:
   selection:
-    runs-on: ubuntu-24.04
+    name: Select analysis languages
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
-      contents: read
-      pull-requests: read
+      contents: read  # Read source for path selection.
+      pull-requests: read  # Compare the pull request's changed paths.
     outputs:
       languages: ${{ steps.changes.outputs.changes }}
     steps:
@@ -44,11 +45,13 @@ jobs:
     name: Analyze (${{ matrix.language }})
     needs: [selection]
     if: needs.selection.outputs.languages != '[]'
-    runs-on: ${{ matrix.language == 'rust' && 'windows-2022' || 'ubuntu-24.04' }}
+    runs-on: ${{ matrix.language == 'rust' && 'windows-2022' || 'ubuntu-26.04' }}
     timeout-minutes: 45
     permissions:
-      contents: read
-      security-events: write
+      contents: read  # Read the source to analyze.
+      security-events: write  # Upload the analysis results.
+    env:
+      RUSTUP_TOOLCHAIN: "1.99.1"
     strategy:
       fail-fast: false
       matrix:
@@ -57,10 +60,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - if: matrix.language == 'rust'
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8  # v1
-        with:
-          toolchain: "1.99.1"
+      - name: Install pinned Rust toolchain
+        if: matrix.language == 'rust'
+        run: rustup toolchain install 1.99.1 --profile minimal
       - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           languages: ${{ matrix.language }}
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 22bca6c..7e40fcb 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,7 +10,7 @@ permissions:
 jobs:
   dependency-review:
     name: Dependency review
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a4a1fb5..1c2b14c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,7 +79,7 @@ jobs:
     name: Qualify the release revision
     if: always()
     needs: [quality, test, i686-smoke, arm64, verifier, api, proofs]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -116,7 +116,7 @@ jobs:
   quality:
     name: Release repository checks
     needs: resolve
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     permissions:
       contents: read
@@ -334,7 +334,7 @@ jobs:
       fail-fast: false
       matrix:
         layer: ${{ fromJSON(needs.quality.outputs.proofs) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: read
diff --git a/.github/workflows/verify-doppler.yml b/.github/workflows/verify-doppler.yml
index 9992374..7128eb2 100644
--- a/.github/workflows/verify-doppler.yml
+++ b/.github/workflows/verify-doppler.yml
@@ -20,7 +20,7 @@ jobs:
     if: >-
       github.event_name == 'workflow_dispatch' &&
       github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     environment: release
     permissions: