diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c583a6f..e0566e0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ concurrency:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     name: Check
     steps:
       - uses: actions/checkout@v4
@@ -50,7 +50,7 @@ jobs:
 
   test:
     needs: check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     continue-on-error: false
     strategy:
       fail-fast: true
@@ -101,7 +101,7 @@ jobs:
   # to OpenSSL.
   openssl-matrix:
     needs: check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     strategy:
       # Report every binding's result; one failing version must not mask another.
       fail-fast: false
@@ -131,8 +131,9 @@ jobs:
         with:
           luarocksVersion: "3.12.2"
 
+      # GCC 14+ makes incompatible-pointer-types an error, which 0.8.5's ocsp.c trips.
       - name: Install lua-openssl ${{ matrix.rock }}
-        run: luarocks install openssl ${{ matrix.rock }}
+        run: luarocks install openssl ${{ matrix.rock }} CFLAGS="-O2 -fPIC -Wno-error=incompatible-pointer-types"
 
       - name: Assert the feature gate resolves as measured
         env:
@@ -177,7 +178,7 @@ jobs:
 
   build:
     needs: [test, openssl-matrix]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     name: Build Combined Module
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f4cf9fd..5ca96ef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4