diff --git a/.github/workflows/ci-pr.yml b/.github/workflows/ci-pr.yml
index 8f508df8..0e2081f0 100644
--- a/.github/workflows/ci-pr.yml
+++ b/.github/workflows/ci-pr.yml
@@ -62,7 +62,10 @@ env:
 jobs:
   checks:
     if: github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    # Playwright 1.58.2 has no ubuntu26.04 build and `ubuntu-latest` migrated
+    # to 26.04 in Oct 2026 (run 42095564329). Pin 24.04 until the Playwright
+    # bump lands; `ubuntu-latest` here breaks every PR at browser install.
+    runs-on: ubuntu-24.04
     timeout-minutes: 50
     services:
       postgres-int:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index cf4386bd..6293213f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -101,7 +101,9 @@ jobs:
   verify:
     needs: [preflight]
     if: needs.preflight.outputs.should_deploy == 'true'
-    runs-on: ubuntu-latest
+    # Same pin as ci-pr: Playwright 1.58.2 has no ubuntu26.04 build and
+    # `ubuntu-latest` migrated to 26.04 in Oct 2026.
+    runs-on: ubuntu-24.04
     timeout-minutes: 50
     services:
       # OPS71 — GitHub hosted: jobs run on the runner VM, so services are