diff --git a/.github/workflows/admob-android-runtime-check.yml b/.github/workflows/admob-android-runtime-check.yml
index e5f7533bab3..8d331069f4e 100644
--- a/.github/workflows/admob-android-runtime-check.yml
+++ b/.github/workflows/admob-android-runtime-check.yml
@@ -21,7 +21,7 @@ concurrency:
 
 jobs:
   banner-measurement:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
diff --git a/.github/workflows/ai-cn1lib-android-check.yml b/.github/workflows/ai-cn1lib-android-check.yml
index c15f538e424..cb4718ac50d 100644
--- a/.github/workflows/ai-cn1lib-android-check.yml
+++ b/.github/workflows/ai-cn1lib-android-check.yml
@@ -22,7 +22,7 @@ on:
 
 jobs:
   android-native-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
       - name: Set up JDK 17
@@ -32,6 +32,11 @@ jobs:
           java-version: '17'
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
+        # The action's default list includes the legacy `tools` package, which
+        # cmdline-tools 16.0 (runner image ubuntu24/20260920) no longer offers,
+        # so `sdkmanager tools` exits 1. The next step installs what we need.
+        with:
+          packages: platform-tools
       - name: Install Android platform & ML Kit deps
         # sdkmanager + `yes |` would SIGPIPE under `set -o pipefail`, so feed
         # licence approvals via printf instead.
diff --git a/.github/workflows/ant.yml b/.github/workflows/ant.yml
index 62dc6fe3e19..b0a47f22cbd 100644
--- a/.github/workflows/ant.yml
+++ b/.github/workflows/ant.yml
@@ -23,7 +23,7 @@ concurrency:
 jobs:
   build-linux-jdk8:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
 
     steps:
diff --git a/.github/workflows/archetype-smoke.yml b/.github/workflows/archetype-smoke.yml
index 778b9579798..a93db1ded41 100644
--- a/.github/workflows/archetype-smoke.yml
+++ b/.github/workflows/archetype-smoke.yml
@@ -48,7 +48,7 @@ concurrency:
 
 jobs:
   archetype-smoke:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
diff --git a/.github/workflows/blog-prose.yml b/.github/workflows/blog-prose.yml
index a0da186cfa7..f298874d209 100644
--- a/.github/workflows/blog-prose.yml
+++ b/.github/workflows/blog-prose.yml
@@ -34,7 +34,7 @@ jobs:
   gate:
     name: Blog prose gate
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
@@ -202,7 +202,7 @@ jobs:
   # --------------------------------------------------------------------------- #
   report:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
diff --git a/.github/workflows/blog-syndication.yml b/.github/workflows/blog-syndication.yml
index 17319db5290..2afbd3102a8 100644
--- a/.github/workflows/blog-syndication.yml
+++ b/.github/workflows/blog-syndication.yml
@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   syndicate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
index f75a5ca1d04..f51a124a752 100644
--- a/.github/workflows/build-container.yml
+++ b/.github/workflows/build-container.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   build-and-push:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/car-android.yml b/.github/workflows/car-android.yml
index 1a2c9747518..063470f6381 100644
--- a/.github/workflows/car-android.yml
+++ b/.github/workflows/car-android.yml
@@ -56,7 +56,7 @@ jobs:
     name: Car Android Auto
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
diff --git a/.github/workflows/check-16k-page-alignment.yml b/.github/workflows/check-16k-page-alignment.yml
index c54742dd6a3..a1b41211745 100644
--- a/.github/workflows/check-16k-page-alignment.yml
+++ b/.github/workflows/check-16k-page-alignment.yml
@@ -29,7 +29,7 @@ on:
 
 jobs:
   check-16k-page-alignment:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/check-control-characters.yml b/.github/workflows/check-control-characters.yml
index 81a0a94db6a..9bca866660f 100644
--- a/.github/workflows/check-control-characters.yml
+++ b/.github/workflows/check-control-characters.yml
@@ -24,7 +24,7 @@ on:
 
 jobs:
   check-control-characters:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/check-copyright-headers.yml b/.github/workflows/check-copyright-headers.yml
index 734ae27f5c6..e3e1bf1dc79 100644
--- a/.github/workflows/check-copyright-headers.yml
+++ b/.github/workflows/check-copyright-headers.yml
@@ -17,7 +17,7 @@ on:
 
 jobs:
   check-copyright-headers:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/.github/workflows/check-since-tags.yml b/.github/workflows/check-since-tags.yml
index fc3e7dab4db..15409751a02 100644
--- a/.github/workflows/check-since-tags.yml
+++ b/.github/workflows/check-since-tags.yml
@@ -26,7 +26,7 @@ on:
 
 jobs:
   check-since-tags:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/check-workflows.yml b/.github/workflows/check-workflows.yml
index f13c551aa79..41cf1593dd4 100644
--- a/.github/workflows/check-workflows.yml
+++ b/.github/workflows/check-workflows.yml
@@ -28,7 +28,7 @@ on:
 
 jobs:
   check-workflows:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/cn1playground-language.yml b/.github/workflows/cn1playground-language.yml
index c9b2cdf5150..f2175618009 100644
--- a/.github/workflows/cn1playground-language.yml
+++ b/.github/workflows/cn1playground-language.yml
@@ -19,7 +19,7 @@ permissions:
 jobs:
   language-smoke:
     name: Playground language smoke
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Check out repository
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 192b07b1401..42030836d31 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,7 +19,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     permissions:
       security-events: write
diff --git a/.github/workflows/designer.yml b/.github/workflows/designer.yml
index e784ae7ab7c..585271a2431 100644
--- a/.github/workflows/designer.yml
+++ b/.github/workflows/designer.yml
@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build-designer:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
 
     steps:
diff --git a/.github/workflows/developer-guide-docs.yml b/.github/workflows/developer-guide-docs.yml
index 924aa8c08fb..68a2c55794a 100644
--- a/.github/workflows/developer-guide-docs.yml
+++ b/.github/workflows/developer-guide-docs.yml
@@ -59,7 +59,7 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
       issues: write
diff --git a/.github/workflows/errorprone.yml b/.github/workflows/errorprone.yml
index 4639235c4ec..657fa1ce752 100644
--- a/.github/workflows/errorprone.yml
+++ b/.github/workflows/errorprone.yml
@@ -34,7 +34,7 @@ on:
 
 jobs:
   errorprone:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/fidelity-desktop-native-ref.yml b/.github/workflows/fidelity-desktop-native-ref.yml
index 542398ed7f5..5e2981da4f2 100644
--- a/.github/workflows/fidelity-desktop-native-ref.yml
+++ b/.github/workflows/fidelity-desktop-native-ref.yml
@@ -63,7 +63,7 @@ jobs:
   gnome-ref:
     if: ${{ inputs.targets == 'all' || inputs.targets == 'gnome' }}
     name: GNOME (GTK4 + libadwaita)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
       CN1SS_FIDELITY_GOLDEN_SET: gnome-adwaita
diff --git a/.github/workflows/guibuilder.yml b/.github/workflows/guibuilder.yml
index d6813b54e5f..91b15ef81e3 100644
--- a/.github/workflows/guibuilder.yml
+++ b/.github/workflows/guibuilder.yml
@@ -47,7 +47,7 @@ concurrency:
 
 jobs:
   guibuilder:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
     defaults:
diff --git a/.github/workflows/health-android.yml b/.github/workflows/health-android.yml
index 1e567df9661..2822f74d772 100644
--- a/.github/workflows/health-android.yml
+++ b/.github/workflows/health-android.yml
@@ -47,7 +47,7 @@ jobs:
     name: Health Connect Android
     permissions:
       contents: read
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v6
diff --git a/.github/workflows/identity-stack.yml b/.github/workflows/identity-stack.yml
index 8211206afee..fa624f41b91 100644
--- a/.github/workflows/identity-stack.yml
+++ b/.github/workflows/identity-stack.yml
@@ -88,7 +88,7 @@ concurrency:
 jobs:
   linux-tests:
     name: Core tests, plugin & Android compile, sample javac
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Same container the main PR workflow uses; it ships JDK 8/17/21 and
     # cn1-binaries pre-staged at /opt/cn1-binaries.
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
@@ -212,7 +212,7 @@ jobs:
 
   sample-secrets:
     name: Scan demo sample for accidental credentials
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # 10 rather than 3. The scan itself is one grep over ten paths and takes
     # under a second; the three minutes went entirely to checking out a
     # repository this size, and the job was cancelled mid-checkout having done
diff --git a/.github/workflows/initializr-cn1-version-pr.yml b/.github/workflows/initializr-cn1-version-pr.yml
index 0cc9dbd5b03..f8227c1d97b 100644
--- a/.github/workflows/initializr-cn1-version-pr.yml
+++ b/.github/workflows/initializr-cn1-version-pr.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   update-website-cn1-versions:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v6
diff --git a/.github/workflows/java-snippet-validation.yml b/.github/workflows/java-snippet-validation.yml
index b0d34b12cdd..65b36029cae 100644
--- a/.github/workflows/java-snippet-validation.yml
+++ b/.github/workflows/java-snippet-validation.yml
@@ -14,7 +14,7 @@ on:
 
 jobs:
   validate-snippets:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/.github/workflows/javadocs.yml b/.github/workflows/javadocs.yml
index 608bda9841d..cfb27bb2d79 100644
--- a/.github/workflows/javadocs.yml
+++ b/.github/workflows/javadocs.yml
@@ -20,7 +20,7 @@ on:
 
 jobs:
   build-javadocs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/javase-cef-ffmpeg-smoke.yml b/.github/workflows/javase-cef-ffmpeg-smoke.yml
index 2e606807d89..3aa47845723 100644
--- a/.github/workflows/javase-cef-ffmpeg-smoke.yml
+++ b/.github/workflows/javase-cef-ffmpeg-smoke.yml
@@ -48,7 +48,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-24.04, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
 
     steps:
diff --git a/.github/workflows/jsport-barrier-lint.yml b/.github/workflows/jsport-barrier-lint.yml
index 37265d228b2..c545593ae42 100644
--- a/.github/workflows/jsport-barrier-lint.yml
+++ b/.github/workflows/jsport-barrier-lint.yml
@@ -25,7 +25,7 @@ name: JS port barrier-read lint
 jobs:
   barrier-lint:
     name: JS port canvas barrier-read lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
       - name: Run barrier-read linter
diff --git a/.github/workflows/linux-browser-link.yml b/.github/workflows/linux-browser-link.yml
index 70f0696926c..0d6e7635153 100644
--- a/.github/workflows/linux-browser-link.yml
+++ b/.github/workflows/linux-browser-link.yml
@@ -9,7 +9,7 @@ jobs:
   browser-link:
     strategy:
       matrix:
-        runner: [ubuntu-latest, ubuntu-24.04-arm]
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/linux-build-run.yml b/.github/workflows/linux-build-run.yml
index ff633bfdbf4..f4b426227f1 100644
--- a/.github/workflows/linux-build-run.yml
+++ b/.github/workflows/linux-build-run.yml
@@ -1,7 +1,7 @@
 # Native Linux (GTK3) build + run pipeline. The Linux port builds natively on the
 # runner -- no cross-compile -- so each architecture both builds and runs the
 # binary. It runs on BOTH architectures GitHub hosts natively: x86_64
-# (ubuntu-latest) and arm64 (ubuntu-24.04-arm), giving the port the same two-arch
+# (ubuntu-24.04) and arm64 (ubuntu-24.04-arm), giving the port the same two-arch
 # screenshot coverage the native Windows port has.
 #
 # The hellocodenameone screenshot suite is compiled by the codenameone maven
@@ -92,7 +92,7 @@ jobs:
   # so both arch legs translate from these same classes.
   prepare-suite:
     name: build suite classes (x64)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - name: Check out repository
@@ -163,7 +163,7 @@ jobs:
       matrix:
         include:
           - arch: x64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
           - arch: arm64
             runner: ubuntu-24.04-arm
     steps:
@@ -471,7 +471,7 @@ jobs:
   build-run-musl:
     name: build + run suite (musl, Alpine x64)
     needs: prepare-suite
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - name: Download suite classes
@@ -554,7 +554,7 @@ jobs:
       !cancelled() &&
       (github.event_name == 'pull_request' || github.event_name == 'push' ||
       github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       # write, because this job publishes the normalized report to the
       # port-status-data branch itself (see the publish step below).
diff --git a/.github/workflows/material-icons-update.yml b/.github/workflows/material-icons-update.yml
index ce25a65be1a..ed74d12b329 100644
--- a/.github/workflows/material-icons-update.yml
+++ b/.github/workflows/material-icons-update.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   update-material-icons:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Check out repository
diff --git a/.github/workflows/native-themes-sync.yml b/.github/workflows/native-themes-sync.yml
index e5666d6395a..29ea0786b5e 100644
--- a/.github/workflows/native-themes-sync.yml
+++ b/.github/workflows/native-themes-sync.yml
@@ -36,7 +36,7 @@ concurrency:
 
 jobs:
   rebuild-and-commit:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
     defaults:
       run:
diff --git a/.github/workflows/oss-traction.yml b/.github/workflows/oss-traction.yml
index 41785cbe8c1..87f60b360e7 100644
--- a/.github/workflows/oss-traction.yml
+++ b/.github/workflows/oss-traction.yml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   snapshot:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out default branch
         uses: actions/checkout@v6
diff --git a/.github/workflows/parparvm-parallel-mark.yml b/.github/workflows/parparvm-parallel-mark.yml
index 119f1c3b63f..38970bc3614 100644
--- a/.github/workflows/parparvm-parallel-mark.yml
+++ b/.github/workflows/parparvm-parallel-mark.yml
@@ -111,7 +111,7 @@ jobs:
           # x64 as well, so a failure can be attributed to the architecture rather
           # than to the pool itself.
           - arch: x64
-            runner: ubuntu-latest
+            runner: ubuntu-24.04
             markers: 4
             cflags: '-DCN1_GC_MARK_THREADS=4'
     steps:
diff --git a/.github/workflows/parparvm-selfhost.yml b/.github/workflows/parparvm-selfhost.yml
index 7ba516ab3c5..92f9607bfd7 100644
--- a/.github/workflows/parparvm-selfhost.yml
+++ b/.github/workflows/parparvm-selfhost.yml
@@ -50,7 +50,7 @@ jobs:
     if: >-
       github.event_name != 'pull_request' ||
       contains(github.event.pull_request.labels.*.name, 'selfhost')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 120
     steps:
       - name: Check out repository
diff --git a/.github/workflows/parparvm-tests-windows.yml b/.github/workflows/parparvm-tests-windows.yml
index 62b427fd1bd..afce7517095 100644
--- a/.github/workflows/parparvm-tests-windows.yml
+++ b/.github/workflows/parparvm-tests-windows.yml
@@ -746,7 +746,7 @@ jobs:
       needs.windows-port-screenshot.result != 'cancelled' &&
       needs.windows-port-screenshot.result != 'skipped' &&
       (github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
@@ -847,7 +847,7 @@ jobs:
       needs.windows-port-screenshot-arm64.result != 'cancelled' &&
       needs.windows-port-screenshot-arm64.result != 'skipped' &&
       (github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/parparvm-tests.yml b/.github/workflows/parparvm-tests.yml
index 081cc04d2cd..21b51762e05 100644
--- a/.github/workflows/parparvm-tests.yml
+++ b/.github/workflows/parparvm-tests.yml
@@ -93,7 +93,7 @@ env:
 
 jobs:
   vm-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     # The two database engines the backend speaks a wire protocol to.
     #
@@ -442,7 +442,7 @@ jobs:
   # cases it happens to pass.
   backend-websocket-conformance:
     name: WebSocket conformance (Autobahn)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v6
@@ -487,7 +487,7 @@ jobs:
 
   release-jars:
     if: ${{ github.event_name == 'release' && github.event.action == 'published' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     permissions:
       contents: write
diff --git a/.github/workflows/port-status-contract.yml b/.github/workflows/port-status-contract.yml
index 5eeb164f614..1601cf301fc 100644
--- a/.github/workflows/port-status-contract.yml
+++ b/.github/workflows/port-status-contract.yml
@@ -71,7 +71,7 @@ permissions:
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/port-status-nightly.yml b/.github/workflows/port-status-nightly.yml
index 7cd0bdc75e3..240920c5e90 100644
--- a/.github/workflows/port-status-nightly.yml
+++ b/.github/workflows/port-status-nightly.yml
@@ -20,7 +20,7 @@ jobs:
   # contract's staleness window.
   publish-latest-port-reports:
     if: github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
@@ -30,7 +30,7 @@ jobs:
         run: scripts/hellocodenameone/conformance/backfill_port_status.sh
 
   build-javascript-app:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v6
@@ -63,7 +63,7 @@ jobs:
 
   browser-lifecycle:
     needs: build-javascript-app
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     strategy:
       fail-fast: false
@@ -114,7 +114,7 @@ jobs:
     # some later deployment. The two concerns are now separated.
     if: always()
     needs: [build-javascript-app, browser-lifecycle, publish-latest-port-reports]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
       - uses: actions/download-artifact@v4
diff --git a/.github/workflows/port-status-publish.yml b/.github/workflows/port-status-publish.yml
index 69586ceef18..d58f1d38537 100644
--- a/.github/workflows/port-status-publish.yml
+++ b/.github/workflows/port-status-publish.yml
@@ -39,7 +39,7 @@ jobs:
       github.event.workflow_run.conclusion != 'skipped' &&
       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'schedule') &&
       github.event.workflow_run.head_branch == 'master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 637c8032c14..76f7bca60a0 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -153,7 +153,7 @@ concurrency:
 jobs:
   build-test:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
     env:
@@ -935,7 +935,7 @@ jobs:
     # pull request the image is never fetched.
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
     needs: build-test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Download the distribution bundle
         uses: actions/download-artifact@v7
diff --git a/.github/workflows/protocol-e2e.yml b/.github/workflows/protocol-e2e.yml
index 7ed725f0dca..22a89c38613 100644
--- a/.github/workflows/protocol-e2e.yml
+++ b/.github/workflows/protocol-e2e.yml
@@ -28,7 +28,7 @@ on:
 
 jobs:
   protocol-e2e:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
     timeout-minutes: 40
     steps:
diff --git a/.github/workflows/publish-master-snapshot.yml b/.github/workflows/publish-master-snapshot.yml
index e6c0a0a442b..d0afa7894ac 100644
--- a/.github/workflows/publish-master-snapshot.yml
+++ b/.github/workflows/publish-master-snapshot.yml
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v6
       - name: Set up JDK 8
diff --git a/.github/workflows/purchase-e2e.yml b/.github/workflows/purchase-e2e.yml
index 524808d96c0..1e1caec21f6 100644
--- a/.github/workflows/purchase-e2e.yml
+++ b/.github/workflows/purchase-e2e.yml
@@ -75,7 +75,7 @@ concurrency:
 jobs:
   core-tests:
     name: Core receipt-sync unit tests (JavaSE)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container: ghcr.io/codenameone/codenameone/pr-ci-container:latest
     timeout-minutes: 20
     defaults:
@@ -235,7 +235,7 @@ jobs:
 
   native-android:
     name: Android billing-bridge purchase (emulator)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e03906dac1c..896118dd33e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Was 240 to cover five 30-minute Maven Central propagation polls. Those are gone
     # with Central, and what remains is the core reactor plus four editors against a
     # repository that either accepts an upload or does not. Still bounded explicitly
diff --git a/.github/workflows/scaffolding-parity.yml b/.github/workflows/scaffolding-parity.yml
index 0c060dc3c88..9803519eb0c 100644
--- a/.github/workflows/scaffolding-parity.yml
+++ b/.github/workflows/scaffolding-parity.yml
@@ -48,7 +48,7 @@ concurrency:
 
 jobs:
   scaffolding-integrity:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # 10 rather than 5, for the reason identity-stack's sample-secrets job
     # carries: checking out a repository this size can take three minutes on its
     # own, and a budget sized for the work rather than for the checkout fails
diff --git a/.github/workflows/scripts-android.yml b/.github/workflows/scripts-android.yml
index 83cbb636c54..87eefecd4d0 100644
--- a/.github/workflows/scripts-android.yml
+++ b/.github/workflows/scripts-android.yml
@@ -141,7 +141,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
diff --git a/.github/workflows/scripts-fidelity-desktop.yml b/.github/workflows/scripts-fidelity-desktop.yml
index 8e51046ead6..27bfbda5690 100644
--- a/.github/workflows/scripts-fidelity-desktop.yml
+++ b/.github/workflows/scripts-fidelity-desktop.yml
@@ -95,7 +95,7 @@ jobs:
   # and costs one ubuntu minute.
   select:
     name: select legs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     outputs:
       matrix: ${{ steps.pick.outputs.matrix }}
       any: ${{ steps.pick.outputs.any }}
@@ -120,7 +120,7 @@ jobs:
           entries=''
           for leg in $legs; do
             case "$leg" in
-              gnome)   runner=ubuntu-latest ;;
+              gnome)   runner=ubuntu-24.04 ;;
               windows) runner=windows-11-arm ;;
               macos)   runner=macos-15 ;;
             esac
diff --git a/.github/workflows/scripts-fidelity.yml b/.github/workflows/scripts-fidelity.yml
index fe5ad3c9a0d..dba14c8a020 100644
--- a/.github/workflows/scripts-fidelity.yml
+++ b/.github/workflows/scripts-fidelity.yml
@@ -112,7 +112,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
diff --git a/.github/workflows/scripts-javascript.yml b/.github/workflows/scripts-javascript.yml
index 9ee59d81a55..38f36acc62a 100644
--- a/.github/workflows/scripts-javascript.yml
+++ b/.github/workflows/scripts-javascript.yml
@@ -106,7 +106,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       # The device runner reports logical test failures through CN1SS log
diff --git a/.github/workflows/scripts-javase.yml b/.github/workflows/scripts-javase.yml
index 1058d34a600..84633599d0c 100644
--- a/.github/workflows/scripts-javase.yml
+++ b/.github/workflows/scripts-javase.yml
@@ -33,7 +33,7 @@ jobs:
       contents: read
       pull-requests: write
       issues: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       GITHUB_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
       GH_TOKEN: ${{ secrets.CN1SS_GH_TOKEN }}
diff --git a/.github/workflows/seed-frozen-artifacts.yml b/.github/workflows/seed-frozen-artifacts.yml
index 1edf22cd1db..221a11a208c 100644
--- a/.github/workflows/seed-frozen-artifacts.yml
+++ b/.github/workflows/seed-frozen-artifacts.yml
@@ -26,7 +26,7 @@ concurrency:
 
 jobs:
   seed:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     env:
       R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
diff --git a/.github/workflows/skin-designer-devices-update.yml b/.github/workflows/skin-designer-devices-update.yml
index 44b95b4ae43..a0365948cd2 100644
--- a/.github/workflows/skin-designer-devices-update.yml
+++ b/.github/workflows/skin-designer-devices-update.yml
@@ -18,7 +18,7 @@ jobs:
   update-device-db:
     # Only run on the canonical repo's master, never on forks or feature branches.
     if: github.repository == 'codenameone/CodenameOne' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # Cold runs (empty cache) can take 30–60 min to walk the curated brands;
     # warm runs are typically a few minutes.
     timeout-minutes: 75
diff --git a/.github/workflows/starter-canary.yml b/.github/workflows/starter-canary.yml
index 93ba7a57e60..efc75e3fa83 100644
--- a/.github/workflows/starter-canary.yml
+++ b/.github/workflows/starter-canary.yml
@@ -45,7 +45,7 @@ concurrency:
 jobs:
   self-test:
     name: Canary assertions still fire
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
@@ -70,7 +70,7 @@ jobs:
       # masking a platform-specific launcher failure.
       max-parallel: 1
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-24.04, windows-latest]
     runs-on: ${{ matrix.os }}
     # Must exceed everything starter_canary.py can spend: HTTP_ALLOWANCE 10m +
     # SEED_TIMEOUT 10m + LAUNCH_TIMEOUT 30m + POLL_TIMEOUT 20m = 70m, plus
@@ -159,7 +159,7 @@ jobs:
   alert:
     needs: canary
     if: always() && github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       issues: write
@@ -205,7 +205,7 @@ jobs:
             };
 
             const results = [
-              read('ubuntu-latest', 'Linux'),
+              read('ubuntu-24.04', 'Linux'),
               read('windows-latest', 'Windows'),
             ];
             const problems = results.map(r => r.problem).filter(Boolean);
diff --git a/.github/workflows/starter-launchers.yml b/.github/workflows/starter-launchers.yml
index da5a8d9989d..8a414a9ef7a 100644
--- a/.github/workflows/starter-launchers.yml
+++ b/.github/workflows/starter-launchers.yml
@@ -9,7 +9,7 @@ jobs:
   launchers:
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-24.04, windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
diff --git a/.github/workflows/syndication-health.yml b/.github/workflows/syndication-health.yml
index 14751738d7c..3b6e5a7ed6e 100644
--- a/.github/workflows/syndication-health.yml
+++ b/.github/workflows/syndication-health.yml
@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Check out default branch
         uses: actions/checkout@v6
diff --git a/.github/workflows/website-docs.yml b/.github/workflows/website-docs.yml
index 9823bf71b85..02f3244cb1c 100644
--- a/.github/workflows/website-docs.yml
+++ b/.github/workflows/website-docs.yml
@@ -91,7 +91,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A ceiling, because there was not one: this job hung in apt and ran for six
     # hours before GitHub's own limit stopped it.
     timeout-minutes: 90
diff --git a/.github/workflows/windows-cross-build-run.yml b/.github/workflows/windows-cross-build-run.yml
index 7d62d978b05..f908beacb0d 100644
--- a/.github/workflows/windows-cross-build-run.yml
+++ b/.github/workflows/windows-cross-build-run.yml
@@ -59,7 +59,7 @@ concurrency:
 jobs:
   cross-build:
     name: cross-build suite exe (Linux, x64 + WebView2)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - name: Check out repository
@@ -323,7 +323,7 @@ jobs:
       !cancelled() &&
       (github.event_name == 'pull_request' || github.event_name == 'push' ||
       github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       # write, because this job publishes the normalized report to the
       # port-status-data branch itself (see the publish step below).
diff --git a/.github/workflows/windows-cross-compile.yml b/.github/workflows/windows-cross-compile.yml
index 0e79d54ee9c..f84fa8328ce 100644
--- a/.github/workflows/windows-cross-compile.yml
+++ b/.github/workflows/windows-cross-compile.yml
@@ -33,7 +33,7 @@ concurrency:
 jobs:
   cross-compile:
     name: cross-compile (x64 PE on Linux)
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     # A ceiling, because there was not one: this job hung in apt and ran for six
     # hours before GitHub's own limit stopped it. The work takes well under an
     # hour, so anything past that is stuck rather than slow.