diff --git a/.github/workflows/cli-tests.yml b/.github/workflows/cli-tests.yml
index 42e0967..31f30ac 100644
--- a/.github/workflows/cli-tests.yml
+++ b/.github/workflows/cli-tests.yml
@@ -13,7 +13,9 @@ on:
 jobs:
 
   run_ci:
-    runs-on: ${{ matrix.os.image }}
+    # Linux is pinned because Ubuntu 26.04 (ubuntu-latest) removed apt-key; see LP-1474.
+    # matrix.os.image stays ubuntu-latest so required check names don't change.
+    runs-on: ${{ matrix.os.name == 'linux' && 'ubuntu-24.04' || matrix.os.image }}
     env:
       DEVSTACK_WORKSPACE: /tmp
       SHALLOW_CLONE: 1
diff --git a/.github/workflows/provisioning-tests.yml b/.github/workflows/provisioning-tests.yml
index 45c950b..62bfa15 100644
--- a/.github/workflows/provisioning-tests.yml
+++ b/.github/workflows/provisioning-tests.yml
@@ -19,7 +19,9 @@ on:
 jobs:
 
   run_ci:
-    runs-on: ${{ matrix.os }}
+    # Pinned because Ubuntu 26.04 (ubuntu-latest) removed apt-key; see LP-1474.
+    # matrix.os stays ubuntu-latest so required check names don't change.
+    runs-on: ubuntu-24.04
     env:
       DEVSTACK_WORKSPACE: /tmp
       SHALLOW_CLONE: 1