diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1d41bf1a3..4b179c7a9 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -24,7 +24,7 @@ env:
   BUILDX_VERSION: v0.23.0
 jobs:
   setup:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     outputs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
@@ -41,7 +41,7 @@ jobs:
     env:
       VERSION: v0.0.1-test
       SUBSTRATE_VERSION: 0.0.20
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     timeout-minutes: 30
     steps:
       - name: Checkout repository
@@ -49,7 +49,7 @@ jobs:
       - name: Initialize Environment
         uses: ./.github/actions/initialize-environment
       - name: Allow unprivileged user namespaces
-        # Ubuntu 24.04 (ubuntu-latest) enables AppArmor-based restrictions on
+        # Ubuntu 24.04 (cncf-ubuntu-16-64-x86) enables AppArmor-based restrictions on
         # unprivileged user namespaces by default, which causes bubblewrap
         # to fail with EPERM on unshare(CLONE_NEWUSER)
         # See https://github.com/openai/codex/issues/14919
@@ -164,7 +164,7 @@ jobs:
 
   query-contraction-check:
     name: Query Contraction Check
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -185,7 +185,7 @@ jobs:
 
   proto-check:
     name: Protobuf Contract Check
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -207,7 +207,7 @@ jobs:
       - setup
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       fail-fast: false
       matrix:
@@ -253,7 +253,7 @@ jobs:
       - setup
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       fail-fast: false
       matrix:
@@ -295,7 +295,7 @@ jobs:
           kubectl logs -n kagent deployment/kagent-controller || true
 
   go-unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -322,7 +322,7 @@ jobs:
   helm-unit-tests:
     env:
       VERSION: v0.0.1-test
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -346,7 +346,7 @@ jobs:
           helm unittest helm/tools/grafana-mcp
 
   ui-tests:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write
@@ -402,7 +402,7 @@ jobs:
           - acp-sandbox-hermes
           - acp-sandbox-openclaw
           - acp-sandbox-claude
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     services:
       registry:
         image: registry:2
@@ -438,7 +438,7 @@ jobs:
         working-directory: ./
 
   go-lint:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -456,7 +456,7 @@ jobs:
   python-test:
     env:
       OPENAI_API_KEY: fake
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     strategy:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
@@ -483,7 +483,7 @@ jobs:
         run: make test
 
   python-lint:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -515,7 +515,7 @@ jobs:
           fi
 
   manifests-check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
diff --git a/.github/workflows/conventional-label.yml b/.github/workflows/conventional-label.yml
index 86a6b854f..b7c589ef9 100644
--- a/.github/workflows/conventional-label.yml
+++ b/.github/workflows/conventional-label.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   label-by-title:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/image-scan.yaml b/.github/workflows/image-scan.yaml
index 573496526..af72fbde2 100644
--- a/.github/workflows/image-scan.yaml
+++ b/.github/workflows/image-scan.yaml
@@ -42,7 +42,7 @@ jobs:
           - build_target: golang-adk
             image_name: golang-adk
             tag_suffix: ""
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     services:
       registry:
         image: registry:2
diff --git a/.github/workflows/label-pull-requests.yml b/.github/workflows/label-pull-requests.yml
index 82908451a..8ee116c53 100644
--- a/.github/workflows/label-pull-requests.yml
+++ b/.github/workflows/label-pull-requests.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   label-by-files:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/migration-immutability.yaml b/.github/workflows/migration-immutability.yaml
index dfb5d23cb..53efef635 100644
--- a/.github/workflows/migration-immutability.yaml
+++ b/.github/workflows/migration-immutability.yaml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/.github/workflows/run-agent-framework-test.yaml b/.github/workflows/run-agent-framework-test.yaml
index 07090efe5..aeab93a76 100644
--- a/.github/workflows/run-agent-framework-test.yaml
+++ b/.github/workflows/run-agent-framework-test.yaml
@@ -63,7 +63,7 @@ jobs:
         - { name: scn1_ch22, scenario: scenario1, challenge: service-incorrect-port-number.yaml}
         - { name: scn1_ch23, scenario: scenario1, challenge: missing-service-selector.yaml}
         - { name: scn1_ch24, scenario: scenario1, challenge: pod-security-context-issue.yaml}
-    runs-on: ['ubuntu-latest']
+    runs-on: ['cncf-ubuntu-16-64-x86']
     steps:
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
@@ -150,7 +150,7 @@ jobs:
   summarize-results:
     needs: [solve-challenge]
     if: always()
-    runs-on: ['ubuntu-latest']
+    runs-on: ['cncf-ubuntu-16-64-x86']
     steps:
     - name: Summarize results
       run: |
@@ -159,4 +159,4 @@ jobs:
         EOF
         cat out.yaml
         echo "success: $(cat out.yaml|grep "status: success" |wc -l)"
-        echo "failures: $(cat out.yaml|grep "status: failure" |wc -l)"
\ No newline at end of file
+        echo "failures: $(cat out.yaml|grep "status: failure" |wc -l)"
diff --git a/.github/workflows/sqlc-generate-check.yaml b/.github/workflows/sqlc-generate-check.yaml
index 4efb50604..29499ca03 100644
--- a/.github/workflows/sqlc-generate-check.yaml
+++ b/.github/workflows/sqlc-generate-check.yaml
@@ -10,7 +10,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     steps:
       - uses: actions/checkout@v6
 
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index a1a0769e0..79314a175 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -24,7 +24,7 @@ jobs:
           - acp-sandbox-hermes
           - acp-sandbox-openclaw
           - acp-sandbox-claude
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -64,7 +64,7 @@ jobs:
   push-helm-chart:
     needs:
     - push-images
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -89,7 +89,7 @@ jobs:
         fi
         make helm-publish
   release-python-packages:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       packages: write
@@ -143,7 +143,7 @@ jobs:
     needs:
     - push-helm-chart
     - release-python-packages
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/ui-chromatic.yaml b/.github/workflows/ui-chromatic.yaml
index 7aa13e865..b10d8e8ee 100644
--- a/.github/workflows/ui-chromatic.yaml
+++ b/.github/workflows/ui-chromatic.yaml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   chromatic:
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/ui-playwright.yaml b/.github/workflows/ui-playwright.yaml
index 738851c81..652186e65 100644
--- a/.github/workflows/ui-playwright.yaml
+++ b/.github/workflows/ui-playwright.yaml
@@ -29,7 +29,7 @@ jobs:
   playwright:
     # Disabled until the Kind setup provisions Agent Substrate for SandboxAgent.
     if: false
-    runs-on: ubuntu-latest
+    runs-on: cncf-ubuntu-16-64-x86
     permissions:
       contents: read
     steps: