diff --git a/.github/workflows/.test-bake.yml b/.github/workflows/.test-bake.yml
index 89fde69a..e122f48c 100644
--- a/.github/workflows/.test-bake.yml
+++ b/.github/workflows/.test-bake.yml
@@ -71,7 +71,7 @@ jobs:
           connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
 
   bake-dockerhub-single-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-dockerhub-single
     steps:
@@ -157,9 +157,9 @@ jobs:
       output: image
       push: ${{ github.event_name != 'pull_request' }}
       runner: |
-        default=ubuntu-24.04
-        linux/arm=ubuntu-24.04-arm
-        linux/arm64=ubuntu-24.04-arm
+        default=ubuntu-26.04
+        linux/arm=ubuntu-26.04-arm
+        linux/arm64=ubuntu-26.04-arm
       sbom: true
       set: |
         *.args.VERSION={{meta.version}}
@@ -191,7 +191,7 @@ jobs:
           connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
 
   bake-dockerhub-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-dockerhub
     steps:
@@ -206,7 +206,7 @@ jobs:
             core.info(JSON.stringify(builderOutputs, null, 2));
 
   bake-dockerhub-scan:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' }}
     needs:
       - bake-dockerhub
@@ -252,7 +252,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.bake-dockerhub-nosign.outputs) }}
 
   bake-dockerhub-nosign-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-dockerhub-nosign
     steps:
@@ -318,7 +318,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
   bake-ghcr-and-dockerhub-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-ghcr-and-dockerhub
     steps:
@@ -356,7 +356,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.bake-local.outputs) }}
 
   bake-local-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-local
     steps:
@@ -393,7 +393,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.bake-local-single.outputs) }}
 
   bake-local-single-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-local-single
     steps:
@@ -427,7 +427,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.bake-local-noupload.outputs) }}
 
   bake-local-noupload-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-local-noupload
     steps:
@@ -463,7 +463,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.bake-local-nosign.outputs) }}
 
   bake-local-nosign-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - bake-local-nosign
     steps:
@@ -504,7 +504,7 @@ jobs:
       contents: read
       id-token: write
     with:
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
       context: test
       output: image
       push: false
diff --git a/.github/workflows/.test-build.yml b/.github/workflows/.test-build.yml
index fb3b151a..65038afd 100644
--- a/.github/workflows/.test-build.yml
+++ b/.github/workflows/.test-build.yml
@@ -70,7 +70,7 @@ jobs:
           connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
 
   build-dockerhub-single-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-dockerhub-single
     steps:
@@ -156,9 +156,9 @@ jobs:
       platforms: linux/amd64,linux/arm64
       push: ${{ github.event_name != 'pull_request' }}
       runner: |
-        default=ubuntu-24.04
-        linux/arm=ubuntu-24.04-arm
-        linux/arm64=ubuntu-24.04-arm
+        default=ubuntu-26.04
+        linux/arm=ubuntu-26.04-arm
+        linux/arm64=ubuntu-26.04-arm
       sbom: true
       registry-identities: |
         - type: dockerhub
@@ -187,7 +187,7 @@ jobs:
           connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
 
   build-dockerhub-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-dockerhub
     steps:
@@ -202,7 +202,7 @@ jobs:
             core.info(JSON.stringify(builderOutputs, null, 2));
 
   build-dockerhub-scan:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event_name != 'pull_request' }}
     needs:
       - build-dockerhub
@@ -248,7 +248,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.build-dockerhub-nosign.outputs) }}
 
   build-dockerhub-nosign-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-dockerhub-nosign
     steps:
@@ -299,7 +299,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
   build-ghcr-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-ghcr
     steps:
@@ -365,7 +365,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
   build-ghcr-and-dockerhub-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-ghcr-and-dockerhub
     steps:
@@ -403,7 +403,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.build-local.outputs) }}
 
   build-local-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-local
     steps:
@@ -439,7 +439,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.build-local-single.outputs) }}
 
   build-local-single-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-local-single
     steps:
@@ -473,7 +473,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.build-local-noupload.outputs) }}
 
   build-local-noupload-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-local-noupload
     steps:
@@ -509,7 +509,7 @@ jobs:
       builder-outputs: ${{ toJSON(needs.build-local-nosign.outputs) }}
 
   build-local-nosign-outputs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - build-local-nosign
     steps:
@@ -548,7 +548,7 @@ jobs:
       contents: read
       id-token: write
     with:
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
       build-args: |
         VERSION={{meta.version}}
       file: test/hello.Dockerfile
diff --git a/.github/workflows/.update-deps.yml b/.github/workflows/.update-deps.yml
index 6030abf5..207a673c 100644
--- a/.github/workflows/.update-deps.yml
+++ b/.github/workflows/.update-deps.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   update:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     environment: update-deps # secrets are gated by this environment
     timeout-minutes: 10
     permissions:
diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index 7ddcd302..710c84e6 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -8,9 +8,9 @@ on:
         description: "GitHub-hosted Linux runner label or platform mapping to build on"
         required: false
         default: |
-          default=ubuntu-24.04
-          linux/arm=ubuntu-24.04-arm
-          linux/arm64=ubuntu-24.04-arm
+          default=ubuntu-26.04
+          linux/arm=ubuntu-26.04-arm
+          linux/arm64=ubuntu-26.04-arm
       distribute:
         type: boolean
         description: "Whether to distribute the build across multiple runners (one platform per runner)"
@@ -213,7 +213,7 @@ jobs:
       registry-identities: ${{ inputs.registry-identities }}
 
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         include:
@@ -1150,7 +1150,7 @@ jobs:
             core.setOutput(`result_${inpIndex}`, JSON.stringify(result));
 
   finalize:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         include:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 12ff8161..3dbcc4ee 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -8,9 +8,9 @@ on:
         description: "GitHub-hosted Linux runner label or platform mapping to build on"
         required: false
         default: |
-          default=ubuntu-24.04
-          linux/arm=ubuntu-24.04-arm
-          linux/arm64=ubuntu-24.04-arm
+          default=ubuntu-26.04
+          linux/arm=ubuntu-26.04-arm
+          linux/arm64=ubuntu-26.04-arm
       distribute:
         type: boolean
         description: "Whether to distribute the build across multiple runners (one platform per runner)"
@@ -224,7 +224,7 @@ jobs:
       registry-identities: ${{ inputs.registry-identities }}
 
   prepare:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         include:
@@ -1047,7 +1047,7 @@ jobs:
             core.setOutput(`result_${inpIndex}`, JSON.stringify(result));
 
   finalize:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       matrix:
         include:
diff --git a/.github/workflows/setup-registry-identities.yml b/.github/workflows/setup-registry-identities.yml
index be481c47..3b39a2b8 100644
--- a/.github/workflows/setup-registry-identities.yml
+++ b/.github/workflows/setup-registry-identities.yml
@@ -101,7 +101,7 @@ env:
 
 jobs:
   setup-registry-identities:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       aws-ecr-enabled: ${{ steps.validate.outputs.aws-ecr-enabled }}
       aws-ecr-registry: ${{ steps.validate.outputs.aws-ecr-registry }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 63666db1..5a5ad76b 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -36,7 +36,7 @@ jobs:
       registry-identities: ${{ inputs.registry-identities }}
 
   verify:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - registry-identities
     env:
diff --git a/README.md b/README.md
index db054ecc..810a5637 100644
--- a/README.md
+++ b/README.md
@@ -723,16 +723,16 @@ The `runner` input accepts either a single GitHub-hosted Linux runner label or a
 newline-delimited platform mapping. A single label is used for every build:
 
 ```yaml
-runner: ubuntu-24.04
+runner: ubuntu-26.04
 ```
 
 The default value uses the standard GitHub-hosted Ubuntu runners:
 
 ```yaml
 runner: |
-  default=ubuntu-24.04
-  linux/arm=ubuntu-24.04-arm
-  linux/arm64=ubuntu-24.04-arm
+  default=ubuntu-26.04
+  linux/arm=ubuntu-26.04-arm
+  linux/arm64=ubuntu-26.04-arm
 ```
 
 A mapping must define a `default` runner. Additional keys are platform prefixes,
@@ -740,9 +740,9 @@ and the most specific matching prefix wins. For example:
 
 ```yaml
 runner: |
-  default=ubuntu-24.04
-  linux=ubuntu-24.04
-  linux/arm=ubuntu-24.04-arm
+  default=ubuntu-26.04
+  linux=ubuntu-26.04
+  linux/arm=ubuntu-26.04-arm
 ```
 
 For example, `linux` matches all Linux platforms, `linux/arm` matches variants