diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml
index d5be0c717..367c1dd58 100644
--- a/.github/workflows/_lint.yml
+++ b/.github/workflows/_lint.yml
@@ -10,7 +10,11 @@ permissions:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    # Pinned, not ubuntu-latest: the LLVM install below adds an
+    # apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
+    # GitHub moves ubuntu-latest to the next LTS this job breaks on a day
+    # nobody chose. Pin the runner to the release the repo line already names.
+    runs-on: ubuntu-24.04
     # 15 min proved too tight on a slow runner day and a timed-out lint reads
     # as "cancelled", which the release graph must treat as a hard stop; keep
     # a bound, but one only a genuine hang can hit (normal runtime ~5 min).
@@ -60,7 +64,8 @@ jobs:
   # provability (never suppressed — the NOLINT ban applies here too).
   # Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
   lint-mem:
-    runs-on: ubuntu-latest
+    # Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 7ccd56bf5..61ab9d0e0 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -245,7 +245,9 @@ jobs:
   # parallel suite — catches what an older compiler-rt can miss. Same
   # canonical scripts/test.sh wave as every other leg.
   test-diag:
-    runs-on: ubuntu-latest
+    # Pinned for the same reason as the lint jobs: the pinned diagnostic
+    # toolchain below installs from llvm-toolchain-noble-21.
+    runs-on: ubuntu-24.04
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c0e796364..84e55a97c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -236,8 +236,20 @@ jobs:
       - name: Generate SBOM
         run: python3 scripts/ci/generate-sbom.py "${{ inputs.version }}"
 
+      # actions/attest-sbom is deprecated. What it does now is emit
+      # "::warning::actions/attest-sbom has been deprecated" and forward to
+      # actions/attest with NODE_OPTIONS set, passing sbom-path straight
+      # through. Calling attest directly produces the same attestation without
+      # the wrapper, and sbom-path is a first-class input there (verified
+      # against the action definition at this exact SHA, which is tag v4.1.0).
+      #
+      # This step deliberately carries no continue-on-error: a release must
+      # fail if its SBOM cannot be attested. An unattested SBOM is worse than
+      # an absent one, because the artifact still ships looking complete.
       - name: Attest SBOM
-        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        env:
+          NODE_OPTIONS: '--max-http-header-size=32768'
         with:
           subject-path: '*.tar.gz'
           sbom-path: 'sbom.json'