diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e39fb27e..9af8bd37a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         python-version: ['3.14']
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 142a7c8c5..2badebde5 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - run: mkdir $HOME/.ssh
       - name: Remove and cleanup mysql
diff --git a/roles/php/tasks/main.yml b/roles/php/tasks/main.yml
index 46a755e00..8b313c392 100644
--- a/roles/php/tasks/main.yml
+++ b/roles/php/tasks/main.yml
@@ -128,10 +128,17 @@
     mode: '0644'
   notify: reload php-fpm
 
+- name: Check for ImageMagick 6 policy.xml
+  stat:
+    path: /etc/ImageMagick-6/policy.xml
+  register: imagemagick6_policy
+
+# ImageMagick 7 (Ubuntu 26.04, Debian 13) doesn't block PDFs by default
 - name: Change ImageMagick policy.xml to allow for PDFs
   replace:
     path: /etc/ImageMagick-6/policy.xml
     regexp: '<policy domain="coder" rights="none" pattern="PDF" />'
     replace: '<policy domain="coder" rights="read" pattern="PDF" />'
     backup: no
+  when: imagemagick6_policy.stat.exists
   notify: reload php-fpm