diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml
index d2e48371..5d7482c9 100644
--- a/.github/workflows/dev.yml
+++ b/.github/workflows/dev.yml
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   set_version:
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       VERSION: ${{ steps.version.outputs.VERSION }}
     steps:
@@ -58,7 +58,7 @@ jobs:
   meta:
     name: Compute image metadata
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.action != 'closed' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       UPLOAD_VERSION: ${{ steps.meta.outputs.upload_version }}
       image_tag: ${{ steps.meta.outputs.image_tag }}
@@ -96,7 +96,7 @@ jobs:
   cleanup_images:
     name: Cleanup PR images
     if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.action == 'closed' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Cleanup OCI images via GitHub API
         run: |
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 27867ad0..d10f2bec 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -11,7 +11,7 @@ on:
         default: now
 jobs:
   checkout:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -34,7 +34,7 @@ jobs:
   meta:
     name: Compute image metadata
     needs: [build]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1e4508ba..6a096f59 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
diff --git a/.github/workflows/upload_oci.yml b/.github/workflows/upload_oci.yml
index b4330d20..855ba65b 100644
--- a/.github/workflows/upload_oci.yml
+++ b/.github/workflows/upload_oci.yml
@@ -20,7 +20,7 @@ jobs:
   upload_gl_artifacts:
     name: upload to OCI
     needs: [ generate_matrix_publish ]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     defaults:
       run:
         shell: bash
@@ -44,7 +44,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: 'v3.1.3'
+          cosign-release: 'v3.1.4'
       - name: Set flavor version reference
         run: |
           git rev-parse HEAD | cut -c1-8 | tee COMMIT
@@ -99,7 +99,7 @@ jobs:
   upload_manifests_entries:
     needs: [ generate_matrix_publish, upload_gl_artifacts ]
     name: upload manifest entries into OCI index
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/upstream-release-watch.yml b/.github/workflows/upstream-release-watch.yml
index 687df1fd..a60189ad 100644
--- a/.github/workflows/upstream-release-watch.yml
+++ b/.github/workflows/upstream-release-watch.yml
@@ -26,7 +26,7 @@ permissions:
 
 jobs:
   track_upstream_release_line:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix: