diff --git a/.github/workflows/ci-changelog.yaml b/.github/workflows/ci-changelog.yaml
index 10b09c19..016fa8f3 100644
--- a/.github/workflows/ci-changelog.yaml
+++ b/.github/workflows/ci-changelog.yaml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   changelog:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/ci-secret.yaml b/.github/workflows/ci-secret.yaml
index ba1bf198..4701e9fb 100644
--- a/.github/workflows/ci-secret.yaml
+++ b/.github/workflows/ci-secret.yaml
@@ -35,7 +35,7 @@ jobs:
   # Only people with write access can dispatch this workflow, so the secrets stay
   # with reviewed code.
   resolve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       pull-requests: read
@@ -84,7 +84,7 @@ jobs:
 
   lint-backend:
     needs: [resolve]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -103,7 +103,7 @@ jobs:
 
   lint-frontend:
     needs: [resolve]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -122,7 +122,7 @@ jobs:
 
   lint-evaluation:
     needs: [resolve]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -141,7 +141,7 @@ jobs:
 
   test:
     needs: [resolve, lint-backend]
-    runs-on: self-hosted
+    runs-on: self-hosted-ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -163,7 +163,7 @@ jobs:
 
   docker-eval:
     needs: [resolve, test, lint-frontend, lint-evaluation]
-    runs-on: self-hosted
+    runs-on: self-hosted-ubuntu-26.04-eval
     # Each eval is paid and holds a self-hosted runner. Run one at a time per
     # target (a PR number, or the branch). A started eval finishes; a newer
     # eval replaces the one that waits.
@@ -324,7 +324,7 @@ jobs:
   baseline-gate:
     if: always() && needs.docker-eval.result == 'success'
     needs: [resolve, docker-eval]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       contents: read
@@ -389,7 +389,7 @@ jobs:
   report:
     if: always() && needs.resolve.outputs.pr != ''
     needs: [resolve, lint-backend, lint-frontend, lint-evaluation, test, docker-eval, baseline-gate]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       actions: read
       pull-requests: write
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 25e3f919..639fbabf 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,7 +10,7 @@ defaults:
 
 jobs:
   lint-backend:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -30,7 +30,7 @@ jobs:
       run: cd backend && make check
 
   lint-frontend:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -50,7 +50,7 @@ jobs:
       run: cd frontend && make check
 
   lint-nextjs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup node
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
@@ -75,7 +75,7 @@ jobs:
       run: yarn lint
 
   lint-evaluation:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -96,7 +96,7 @@ jobs:
 
   test:
     needs: [lint-backend]
-    runs-on: self-hosted
+    runs-on: self-hosted-ubuntu-26.04
     steps:
     - name: Setup python
       uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -113,6 +113,9 @@ jobs:
       run: cd backend && make init-dev
 
     - name: Run unit tests
+      env:
+        # Auto detection sees the shared host's CPUs instead of the slot quota.
+        PYTEST_XDIST_AUTO_NUM_WORKERS: '8'
       working-directory: backend
       run: |
         cp .env.test .env
@@ -120,7 +123,7 @@ jobs:
 
   docker-build:
     needs: [test, lint-frontend, lint-evaluation]
-    runs-on: self-hosted
+    runs-on: self-hosted-ubuntu-26.04
     steps:
     - name: Checkout code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -131,7 +134,7 @@ jobs:
   ci-gate:
     if: always()
     needs: [lint-backend, lint-frontend, lint-nextjs, lint-evaluation, test, docker-build]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Require successful CI jobs
       env:
diff --git a/.github/workflows/upload.yml b/.github/workflows/upload.yml
index f18b004e..14678004 100644
--- a/.github/workflows/upload.yml
+++ b/.github/workflows/upload.yml
@@ -26,7 +26,7 @@ env:
 
 jobs:
   or-manpages:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
     - name: Check the branch
       env:
diff --git a/backend/tests/test_ci_secret_workflow.py b/backend/tests/test_ci_secret_workflow.py
index d0b7b77f..39ee39dc 100644
--- a/backend/tests/test_ci_secret_workflow.py
+++ b/backend/tests/test_ci_secret_workflow.py
@@ -755,7 +755,7 @@ def test_baseline_gate_runs_after_the_eval_on_a_hosted_runner() -> None:
     jobs = yaml.safe_load(WORKFLOW.read_text())["jobs"]
     gate = jobs["baseline-gate"]
 
-    assert gate["runs-on"] == "ubuntu-latest"
+    assert gate["runs-on"] == "ubuntu-26.04"
     assert "docker-eval" in gate["needs"]
     assert "needs.docker-eval.result == 'success'" in gate["if"]
     assert gate["permissions"] == {"actions": "read", "contents": "read"}