diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index d095d6d29d..7bc59c53ab 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -10,7 +10,7 @@ concurrency:
 jobs:
   test:
     name: "Test ${{ matrix.name }}"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     strategy:
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index b93ea0e722..f994f99d10 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -9,7 +9,7 @@ concurrency:
 
 jobs:
   Fuzzing:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Build Fuzzers
       id: build
diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml
index 931a26e8e6..f22622ccef 100644
--- a/.github/workflows/cmake_config.yml
+++ b/.github/workflows/cmake_config.yml
@@ -13,7 +13,7 @@ jobs:
         shell: bash
     strategy:
       matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
+        os: [windows-latest, macos-latest, ubuntu-24.04]
     runs-on: ${{ matrix.os }}
     continue-on-error: false
     name: ${{ matrix.os }}
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 112678fd0d..8d0ad114fa 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   scan:
     name: "Scan"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: github.repository_owner == 'libressl' # Prevent running on forks
     permissions:
       contents: read
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 07f140d212..013480fa4e 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   test:
     name: "Emscripten"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
@@ -42,7 +42,7 @@ jobs:
   # Test ASAN with and without ASM enabled.
   test-asan:
     name: "ASAN (no-asm)"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index 4758d2f52b..0fbd993cf0 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -18,7 +18,7 @@ jobs:
       matrix:
         cc: [ gcc, clang ]
     name: ${{ matrix.cc }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     container:
       image: fedora:rawhide
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index 0aa64d8d33..850dbe2cc6 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -16,7 +16,7 @@ env:
 jobs:
   autoconf:
     name: "autoconf"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
     permissions:
       contents: read
@@ -43,7 +43,7 @@ jobs:
 
   cmake:
     name: "cmake"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
     permissions:
       contents: read
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index af7dfabeab..23fa255577 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -48,7 +48,7 @@ jobs:
   # Test ASAN with and without ASM enabled.
   test-asan:
     name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8fe051ec08..c13592044f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   release:
     name: "Release"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     outputs:
       upload_url: "${{ steps.create_release.outputs.upload_url }}"
     steps:
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index b707c4beb6..4ff41c00fb 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   test:
     name: "Test"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index f68a2aaf10..902e4887b6 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -13,7 +13,7 @@ concurrency:
 jobs:
   test:
     name: "Solaris"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read