diff --git a/.github/workflows/__per-language-bundle-validation.yml b/.github/workflows/__per-language-bundle-validation.yml
index ee779ab40..177f4a0d8 100644
--- a/.github/workflows/__per-language-bundle-validation.yml
+++ b/.github/workflows/__per-language-bundle-validation.yml
@@ -35,37 +35,37 @@ jobs:
       matrix:
         include:
           - language: actions
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             expected-extractors: actions javascript
           - language: cpp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: manual
             build-command: gcc -o main main.c
           - language: csharp
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: go
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: autobuild
           - language: java
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
             build-mode: none
           - language: javascript
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: python
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: ruby
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: rust
-            os: ubuntu-latest
+            os: ubuntu-26.04
             version: linked
           - language: swift
             os: macos-latest-xlarge
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f27de17fd..451238b66 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,7 +22,7 @@ jobs:
   # Identify the CodeQL tool versions to use in the analysis job.
   check-codeql-versions:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     outputs:
       versions: ${{ steps.compare.outputs.versions }}
 
@@ -106,7 +106,7 @@ jobs:
 
   analyze-other:
     if: github.triggering_actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/codescanning-config-cli.yml b/.github/workflows/codescanning-config-cli.yml
index 782031948..b1194460d 100644
--- a/.github/workflows/codescanning-config-cli.yml
+++ b/.github/workflows/codescanning-config-cli.yml
@@ -41,11 +41,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: linked
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: default
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
 
     # Code-Scanning config not created because environment variable is not set
diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml
index 38c4045d3..c9599e446 100644
--- a/.github/workflows/debug-artifacts-failure-safe.yml
+++ b/.github/workflows/debug-artifacts-failure-safe.yml
@@ -47,7 +47,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Dump GitHub event
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml
index 610e1aab8..4e2035b9e 100644
--- a/.github/workflows/debug-artifacts-safe.yml
+++ b/.github/workflows/debug-artifacts-safe.yml
@@ -45,7 +45,7 @@ jobs:
     # stable-v2.20.7 requires an older version of Java than the default on `ubuntu-latest` (`ubuntu-26.04`).
     # We could install that older version on the newer runners, or use the older runner.
     # We do the latter here. This can be removed once we stop supporting `v2.20.7`.
-    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-latest') }}
+    runs-on: ${{ case(matrix.version == 'stable-v2.20.7', 'ubuntu-24.04', 'ubuntu-26.04') }}
 
     steps:
       - name: Check out repository
@@ -84,7 +84,7 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml
index 76ef6e555..4e9a0c7a7 100644
--- a/.github/workflows/post-release-mergeback.yml
+++ b/.github/workflows/post-release-mergeback.yml
@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       baseBranch:
-        description: 'The base branch to merge into'
+        description: "The base branch to merge into"
         default: main
         required: false
 
@@ -24,7 +24,7 @@ defaults:
 
 jobs:
   merge-back:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     if: github.repository == 'github/codeql-action'
     env:
@@ -41,16 +41,16 @@ jobs:
 
       - name: Dump GitHub context
         env:
-          GITHUB_CONTEXT: '${{ toJson(github) }}'
+          GITHUB_CONTEXT: "${{ toJson(github) }}"
         run: echo "${GITHUB_CONTEXT}"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          fetch-depth: 0  # ensure we have all tags and can push commits
+          fetch-depth: 0 # ensure we have all tags and can push commits
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Install JavaScript dependencies
         run: npm ci
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 5d2b1576f..cb6bf9e07 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -25,7 +25,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-26.04, macos-26, windows-2025]
         node-version: [20, 24]
     permissions:
       contents: read
@@ -71,7 +71,7 @@ jobs:
         run: npm test
 
       - name: Lint
-        if: always() && matrix.os != 'windows-latest'
+        if: always() && matrix.os != 'windows-2025'
         run: npm run lint-ci
 
       - name: Upload sarif
@@ -81,7 +81,7 @@ jobs:
         # paired `push` run that the queue branch creates use that ref, so gate on the ref itself
         # rather than the event. The same results are uploaded by the `pull_request` run and again
         # by the `push` run on `main`.
-        if: matrix.os == 'ubuntu-latest' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
+        if: matrix.os == 'ubuntu-26.04' && matrix.node-version == 24 && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/')
         with:
           sarif_file: eslint.sarif
           category: eslint
@@ -93,7 +93,7 @@ jobs:
     if: github.triggering_actor != 'dependabot[bot]'
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
 
     concurrency:
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 8ece992d4..8073c44c3 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -29,7 +29,7 @@ defaults:
 jobs:
   prepare:
     name: "Release info"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.repository == 'github/codeql-action'
 
     permissions:
diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml
index ab169499e..b56b1c827 100644
--- a/.github/workflows/python312-windows.yml
+++ b/.github/workflows/python312-windows.yml
@@ -29,7 +29,7 @@ jobs:
       contents: read
       # We currently need `security-events: read` to access feature flags.
       security-events: read
-    runs-on: windows-latest
+    runs-on: windows-2025
 
     steps:
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml
index 1891f4195..745e84b2e 100644
--- a/.github/workflows/query-filters.yml
+++ b/.github/workflows/query-filters.yml
@@ -25,7 +25,7 @@ jobs:
     name: Query Filters Tests
     if: github.triggering_actor != 'dependabot[bot]'
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml
index 1c174ac7a..c37910a77 100644
--- a/.github/workflows/rebuild.yml
+++ b/.github/workflows/rebuild.yml
@@ -12,7 +12,7 @@ defaults:
 jobs:
   rebuild:
     name: Rebuild Action
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event.label.name == 'Rebuild' || github.event_name == 'workflow_dispatch'
 
     env:
@@ -33,7 +33,7 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
-          cache: 'npm'
+          cache: "npm"
 
       - name: Remove label
         if: github.event_name == 'pull_request'
diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml
index 14a8490b8..81353bfb4 100644
--- a/.github/workflows/rollback-release.yml
+++ b/.github/workflows/rollback-release.yml
@@ -34,7 +34,7 @@ jobs:
   rollback:
     name: "Create rollback release"
     if: github.repository == 'github/codeql-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
 
     # Don't set the deployment environment for test runs
diff --git a/.github/workflows/test-codeql-bundle-all.yml b/.github/workflows/test-codeql-bundle-all.yml
index 477fdf052..cf63b1caa 100644
--- a/.github/workflows/test-codeql-bundle-all.yml
+++ b/.github/workflows/test-codeql-bundle-all.yml
@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - os: ubuntu-latest
+        - os: ubuntu-26.04
           version: nightly-latest
     name: 'CodeQL Bundle All'
     if: github.triggering_actor != 'dependabot[bot]'
diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml
index 43708f573..d7d90b749 100644
--- a/.github/workflows/update-bundle.yml
+++ b/.github/workflows/update-bundle.yml
@@ -20,7 +20,7 @@ defaults:
 jobs:
   update-bundle:
     if: github.event.release.prerelease && startsWith(github.event.release.tag_name, 'codeql-bundle-')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml
index 981a38eac..6ceb30c42 100644
--- a/.github/workflows/update-release-branch.yml
+++ b/.github/workflows/update-release-branch.yml
@@ -26,7 +26,7 @@ jobs:
   update:
     name: "Update release branch"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     if: github.event_name == 'workflow_dispatch'
     needs: [prepare]
     env:
@@ -79,7 +79,7 @@ jobs:
   backport:
     name: "Create backport"
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     environment: Automation
     needs: [prepare]
     if: ${{ (github.event_name == 'push') && needs.prepare.outputs.backport_target_branches != '[]' }}
diff --git a/pr-checks/checks/per-language-bundle-validation.yml b/pr-checks/checks/per-language-bundle-validation.yml
index ad1873673..942611d62 100644
--- a/pr-checks/checks/per-language-bundle-validation.yml
+++ b/pr-checks/checks/per-language-bundle-validation.yml
@@ -3,38 +3,38 @@ description: Validates extraction and analysis using each per-language CodeQL bu
 matrix:
   include:
     - language: actions
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       # Actions also needs the JavaScript extractor.
       expected-extractors: actions javascript
     - language: cpp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: manual
       build-command: gcc -o main main.c
     - language: csharp
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: go
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: autobuild
     - language: java
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
       build-mode: none
     - language: javascript
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: python
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: ruby
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: rust
-      os: ubuntu-latest
+      os: ubuntu-26.04
       version: linked
     - language: swift
       os: macos-latest-xlarge