diff --git a/.github/workflows/auto-approve-claude-lgtm.yml b/.github/workflows/auto-approve-claude-lgtm.yml
index 5f9001f..3a0e68f 100644
--- a/.github/workflows/auto-approve-claude-lgtm.yml
+++ b/.github/workflows/auto-approve-claude-lgtm.yml
@@ -43,7 +43,7 @@ permissions: {}
 
 jobs:
   approve:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     if: >-
       (
         (github.event.review.user.login == 'claude[bot]' && github.event.review.user.id == 209825114) ||
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 9a4119b..7bd9741 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   test:
     name: Test & typecheck
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     strategy:
       matrix:
         node-version: [20.x, 22.x, 24.x]
diff --git a/.github/workflows/cut-release.yml b/.github/workflows/cut-release.yml
index 143feaa..3c3f190 100644
--- a/.github/workflows/cut-release.yml
+++ b/.github/workflows/cut-release.yml
@@ -42,7 +42,7 @@ permissions:
 jobs:
   cut:
     name: Bump, verify, tag, push
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
       # Dry runs never push, so they skip the 1Password/App-token steps and
       # check out with the default read-only GITHUB_TOKEN.
diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml
index 1349378..d1a01eb 100644
--- a/.github/workflows/install-smoke.yml
+++ b/.github/workflows/install-smoke.yml
@@ -42,7 +42,7 @@ on:
 
 jobs:
   smoke:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f94b0b8..f62c6e3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
   release:
     name: Publish to npm + GitHub Release
     needs: checks
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     permissions:
       contents: write
       id-token: write
@@ -129,7 +129,7 @@ jobs:
   update-homebrew:
     name: Bump Homebrew formula
     needs: release
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-24.04
     steps:
       - name: Check for tap token
         id: gate