GitHub Actions ubuntu-latest Is Moving to Ubuntu 26.04 — What You Need to Do Before October 19

GitHub made it official on September 17: the Ubuntu 26.04 runner image for GitHub Actions is generally available for production use on both x64 and arm64. That alone is fine. What’s less fine is the clock that started ticking alongside it — beginning October 19, the ubuntu-latest label starts migrating from Ubuntu 24.04 to 26.04 over a 30-day window. If you haven’t tested your workflows against the new image, some of them will break. Silently, mid-run, in the middle of your sprint.

The Migration Window

The transition isn’t a hard cutover. GitHub is rolling it out gradually between October 19 and November 19, which means different repositories will flip at different times. That sounds reassuring until you realize it also means failures won’t be predictable — your main branch pipeline might run fine for two weeks and then start failing on a Tuesday with no code changes to blame.

The right move is to test on ubuntu-26.04 now, before the window opens. If you find issues you can’t fix in time, pin your workflows to ubuntu-24.04 explicitly. GitHub will keep that image available; it won’t disappear on November 19.

What Actually Breaks

The runner image ships with Ubuntu 26.04 LTS underneath, and that OS has meaningful changes from 24.04. Here are the four most likely culprits in your pipelines:

Python jumped from 3.12 to 3.14

This is the one most teams will hit. The system Python went from 3.12 to 3.14 — two major versions in one runner upgrade. If your workflow installs packages with pinned or deprecated 3.12 APIs, expect failures. Audit your requirements.txt and any Tox configs before the migration window opens. The fix is straightforward: use actions/setup-python with an explicit version.

- uses: actions/setup-python@v5
  with:
    python-version: '3.12'  # Pin explicitly, don't rely on system default

cgroup v1 is gone

Ubuntu 26.04 dropped cgroup v1 entirely. Only cgroup v2 remains. If you’re running Docker containers, Podman, or anything container-flavored in CI, this is worth a careful look. Docker 20.10+ handles cgroup v2 natively, but old Compose files or wrapper scripts that reference v1 behavior can fail in ways that aren’t obvious from the error messages.

Java’s default moved to OpenJDK 25

The system default Java is now OpenJDK 25. Workflows that don’t explicitly set a Java version will silently pick up Java 25 instead of the Java 21 they’ve been using. This matters for Maven, Gradle, and any Java project with compatibility targets. Add actions/setup-java with an explicit version and stop relying on the image default.

apt-key is removed

If your CI scripts add third-party apt repositories using apt-key add, they will fail. The command is gone. The replacement writes a GPG key directly to /etc/apt/keyrings/:

# Before (broken on Ubuntu 26.04):
curl -fsSL https://example.com/key.gpg | apt-key add -

# After (works):
curl -fsSL https://example.com/key.gpg \
  | gpg --dearmor -o /etc/apt/keyrings/example.gpg
echo "deb [signed-by=/etc/apt/keyrings/example.gpg] ..." \
  | tee /etc/apt/sources.list.d/example.list

How to Prepare

The fastest path: add ubuntu-26.04 as a test target in your CI matrix today and run your full suite against it. You don’t need to switch permanently — just find out what breaks.

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-24.04, ubuntu-26.04]
    steps:
      - uses: actions/checkout@v4
      - run: your-build-commands-here

If you find blocking incompatibilities and need time to fix them, pin your production workflows to ubuntu-24.04 explicitly. Do this before October 19, not after your first broken deploy.

jobs:
  build:
    runs-on: ubuntu-24.04  # Pinned — remove once Ubuntu 26 migration is complete

One More Thing: cache-mode Is Now GA

Separate from the runner migration, GitHub also shipped cache-mode to general availability on September 10. It gives you explicit control over cache read/write access at the workflow or job level — useful for pull request workflows where you want to read from cache but not let untrusted PRs write to it. Worth a look if you haven’t configured explicit cache permissions yet. The changelog entry covers the four available modes.

The Bottom Line

October 19 is less than a month away. The things most likely to break — Python version assumptions, cgroup v1 containers, default Java version, and apt-key scripts — are all fixable, but they take actual testing to find. Don’t wait for ubuntu-latest to flip and leave you debugging a broken pipeline with no code changes to explain it. Run the matrix job, see what surfaces, fix it or pin it. Full migration details are in the GitHub Changelog, and runner-images issue #14747 has the complete tool diff.