diff --git a/.github/workflows/build-and-push-bsky-aws.yaml b/.github/workflows/build-and-push-bsky-aws.yaml
index 36b1aa23cb3..e0526ac2241 100644
--- a/.github/workflows/build-and-push-bsky-aws.yaml
+++ b/.github/workflows/build-and-push-bsky-aws.yaml
@@ -12,7 +12,7 @@ env:
 jobs:
   bsky-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-bsky-ghcr.yaml b/.github/workflows/build-and-push-bsky-ghcr.yaml
index 5d22cd9a389..facdd3a8d24 100644
--- a/.github/workflows/build-and-push-bsky-ghcr.yaml
+++ b/.github/workflows/build-and-push-bsky-ghcr.yaml
@@ -14,7 +14,7 @@ env:
 jobs:
   bsky-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-bsync-aws.yaml b/.github/workflows/build-and-push-bsync-aws.yaml
index 7976e537325..cfd0970f573 100644
--- a/.github/workflows/build-and-push-bsync-aws.yaml
+++ b/.github/workflows/build-and-push-bsync-aws.yaml
@@ -12,7 +12,7 @@ env:
 jobs:
   bsync-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-bsync-ghcr.yaml b/.github/workflows/build-and-push-bsync-ghcr.yaml
index dec359e020b..a22718cd00d 100644
--- a/.github/workflows/build-and-push-bsync-ghcr.yaml
+++ b/.github/workflows/build-and-push-bsync-ghcr.yaml
@@ -14,7 +14,7 @@ env:
 jobs:
   bsync-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-ozone-aws.yaml b/.github/workflows/build-and-push-ozone-aws.yaml
index 4cce9a36c2d..84d42407794 100644
--- a/.github/workflows/build-and-push-ozone-aws.yaml
+++ b/.github/workflows/build-and-push-ozone-aws.yaml
@@ -13,7 +13,7 @@ env:
 jobs:
   ozone-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-ozone-ghcr.yaml b/.github/workflows/build-and-push-ozone-ghcr.yaml
index ab37093963d..982f7af73d3 100644
--- a/.github/workflows/build-and-push-ozone-ghcr.yaml
+++ b/.github/workflows/build-and-push-ozone-ghcr.yaml
@@ -14,7 +14,7 @@ env:
 jobs:
   ozone-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-pds-aws.yaml b/.github/workflows/build-and-push-pds-aws.yaml
index 097f782d88e..803a431cd92 100644
--- a/.github/workflows/build-and-push-pds-aws.yaml
+++ b/.github/workflows/build-and-push-pds-aws.yaml
@@ -12,7 +12,7 @@ env:
 jobs:
   pds-container-aws:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/build-and-push-pds-ghcr.yaml b/.github/workflows/build-and-push-pds-ghcr.yaml
index b11230ab531..b6bd6c38ad8 100644
--- a/.github/workflows/build-and-push-pds-ghcr.yaml
+++ b/.github/workflows/build-and-push-pds-ghcr.yaml
@@ -14,7 +14,7 @@ env:
 jobs:
   pds-container-ghcr:
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 34d817a652e..4a296476926 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -13,7 +13,7 @@ jobs:
   build:
     name: Build & Publish
     if: github.repository == 'bluesky-social/atproto'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/repo.yaml b/.github/workflows/repo.yaml
index 85fb369462a..e8db4b20b8d 100644
--- a/.github/workflows/repo.yaml
+++ b/.github/workflows/repo.yaml
@@ -12,7 +12,7 @@ concurrency:
 jobs:
   build:
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate
@@ -42,7 +42,7 @@ jobs:
     strategy:
       matrix:
         shard: [1/8, 2/8, 3/8, 4/8, 5/8, 6/8, 7/8, 8/8]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate
@@ -66,7 +66,7 @@ jobs:
   verify:
     name: Verify
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: corepack enable && corepack prepare --activate