diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml
index 5b6e6ec2211..936cdccebde 100644
--- a/.github/workflows/ghcr-image-build-and-publish.yml
+++ b/.github/workflows/ghcr-image-build-and-publish.yml
@@ -24,7 +24,7 @@ env:
 jobs:
   build:
 
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       packages: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 02113c68336..0f69e8230ee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ env:
 
 jobs:
   release:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     # The maximum access is "read" for PRs from public forked repos
     # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
diff --git a/.github/workflows/workflow-flaky.yml b/.github/workflows/workflow-flaky.yml
index 2bbf64fe5b1..5b18b9ab9c1 100644
--- a/.github/workflows/workflow-flaky.yml
+++ b/.github/workflows/workflow-flaky.yml
@@ -29,7 +29,7 @@ jobs:
         target: ["rootful", "rootless"]
     with:
       timeout: 60
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
       guest: ${{ matrix.guest }}
       target: ${{ matrix.target }}
       go-version: 1.26
@@ -40,11 +40,11 @@ jobs:
     uses: ./.github/workflows/job-test-in-lima-freebsd.yml
     with:
       timeout: 15
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
 
   kube:
     name: "kubernetes"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       ROOTFUL: true
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index 7933223fcc4..4e0c35b8732 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -22,25 +22,25 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             goos: linux
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             goos: freebsd
           - runner: macos-15
             goos: darwin
           # FIXME: this is currently failing in a nonsensical way, so, running on linux instead...
           # - runner: windows-2022
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             goos: windows
           # Additionally lint for canary
           # FIXME: failing since the release of go1.27rc1
-          # - runner: ubuntu-24.04
+          # - runner: ubuntu-26.04
           #   goos: linux
           #   canary: true
     with:
       timeout: 10
       go-version: "1.26"
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
       # Note: in GitHub yaml world, if `matrix.canary` is undefined, and is passed to `inputs.canary`, the job
       # will not run. However, if you test it, it will coerce to `false`, hence:
       canary: ${{ matrix.canary && true || false }}
@@ -53,7 +53,7 @@ jobs:
     with:
       timeout: 5
       go-version: "1.26"
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
 
   # Lint for shell and yaml files
   lint-other:
@@ -61,7 +61,7 @@ jobs:
     uses: ./.github/workflows/job-lint-other.yml
     with:
       timeout: 5
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
 
   # Verify we can actually build on all supported platforms, and a bunch of architectures
   build-for-go:
@@ -79,12 +79,12 @@ jobs:
     with:
       timeout: 10
       go-version: ${{ matrix.go-version }}
-      runner: ubuntu-24.04
+      runner: ubuntu-26.04
       canary: ${{ matrix.canary && true || false }}
 
   zizmor:
     name: "zizmor"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: "Init: checkout"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index 22f45575dc8..5a6e6b05874 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -23,11 +23,11 @@ jobs:
         # Run on all supported platforms but freebsd
         # Additionally run on canary for linux
         include:
-          - runner: "ubuntu-24.04"
+          - runner: "ubuntu-26.04"
           - runner: "macos-15"
           - runner: "windows-2025"
           # FIXME: failing since the release of go1.27rc1
-          # - runner: "ubuntu-24.04"
+          # - runner: "ubuntu-26.04"
           #   canary: true
     with:
       runner: ${{ matrix.runner }}
@@ -48,10 +48,10 @@ jobs:
       matrix:
         include:
           # Build for arm & amd, current containerd
-          - runner: ubuntu-24.04
-          - runner: ubuntu-24.04-arm
+          - runner: ubuntu-26.04
+          - runner: ubuntu-26.04-arm
           # Additionally build for old containerd on amd
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             containerd-version: v1.7.33
     with:
       runner: ${{ matrix.runner }}
@@ -68,14 +68,14 @@ jobs:
         include:
           ###### Rootless
           # amd64
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             target: rootless
           # arm64
-          - runner: ubuntu-24.04-arm
+          - runner: ubuntu-26.04-arm
             target: rootless
             skip-flaky: true
           # port-slirp4netns
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             target: rootless-port-slirp4netns
             skip-flaky: true
           # old containerd + old ubuntu + old rootlesskit
@@ -84,15 +84,15 @@ jobs:
             containerd-version: v1.7.33
             rootlesskit-version: v1.1.1
           # gomodjail
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             target: rootless
             binary: "nerdctl.gomodjail"
           ###### Rootful
           # amd64
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             target: rootful
           # arm64
-          - runner: ubuntu-24.04-arm
+          - runner: ubuntu-26.04-arm
             target: rootful
             skip-flaky: true
           # old containerd + old ubuntu
@@ -100,13 +100,13 @@ jobs:
             target: rootful
             containerd-version: v1.7.33
           # ipv6
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             target: rootful
             ipv6: true
             skip-flaky: true
           # all canary
           # FIXME: failing since the release of go1.27rc1
-          # - runner: ubuntu-24.04
+          # - runner: ubuntu-26.04
           #   target: rootful
           #   canary: true
 
@@ -135,7 +135,7 @@ jobs:
           # - runner: windows-2025
           #   canary: true
           # Test docker on linux
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             binary: docker
     with:
       timeout: 45
@@ -148,7 +148,7 @@ jobs:
       no-hyperv: ${{ matrix.canary && true || false }}
       go-version: 1.26
       windows-cni-version: v0.3.1
-      docker-version: 5:29.6.1-1~ubuntu.24.04~noble
+      docker-version: 5:29.6.1-1~ubuntu.26.04~resolute
       # Windows CI still requires containerd v2.2.
       # [v2.3.0 regression] The virtual machine or container JSON document is invalid. (Hyper-V container)
       # https://github.com/containerd/containerd/issues/13254
diff --git a/.github/workflows/workflow-tigron.yml b/.github/workflows/workflow-tigron.yml
index 576fe49c2c0..f5b09edbd3a 100644
--- a/.github/workflows/workflow-tigron.yml
+++ b/.github/workflows/workflow-tigron.yml
@@ -26,13 +26,13 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
           - runner: macos-15
           - runner: windows-2022
-          - runner: ubuntu-24.04
+          - runner: ubuntu-26.04
             goos: freebsd
           # FIXME: failing since the release of go1.27rc1
-          # - runner: ubuntu-24.04
+          # - runner: ubuntu-26.04
           #   canary: go-canary
     steps:
       - name: "Checkout project"
diff --git a/Dockerfile b/Dockerfile
index 9e9c49c0f03..00ba8160a35 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -44,8 +44,8 @@ ARG GOMODJAIL_VERSION=v0.3.2@c145bb1e36fe0939c5fa0467f2477878dea8e3d9
 # Test deps
 # Currently, the Docker Official Images and the test deps are not pinned by the hash
 ARG GO_VERSION=1.26
-ARG UBUNTU_VERSION=24.04
-ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
+ARG UBUNTU_VERSION=26.04
+ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2
 ARG NYDUS_VERSION=v2.4.3
 ARG SOCI_SNAPSHOTTER_VERSION=0.14.1
 ARG KUBO_VERSION=v0.42.0
diff --git a/hack/provisioning/linux/test-integration-env.sh b/hack/provisioning/linux/test-integration-env.sh
index 530ffd5e827..586b3836a59 100755
--- a/hack/provisioning/linux/test-integration-env.sh
+++ b/hack/provisioning/linux/test-integration-env.sh
@@ -155,6 +155,18 @@ host::configuration(){
   if [ -e /sys/kernel/security/apparmor/profiles ]; then
     /usr/local/bin/nerdctl apparmor load
   fi
+
+  # AppArmor configuration seems needed since Ubuntu 26.04
+  if [ -e /etc/apparmor.d/fusermount3 ] && command -v apparmor_parser >/dev/null; then
+    mkdir -p /etc/apparmor.d/local
+    cat > /etc/apparmor.d/local/fusermount3 <<-'EOF'
+	# Allow the soci-snapshotter to mount FUSE filesystems under its root
+	# (installed by nerdctl's hack/provisioning/linux/test-integration-env.sh)
+	mount fstype=@{fuse_types} -> /var/lib/soci-snapshotter-grpc/**/,
+	umount /var/lib/soci-snapshotter-grpc/**/,
+	EOF
+    apparmor_parser -r /etc/apparmor.d/fusermount3
+  fi
 }
 
 host::services(){