diff --git a/.github/workflows/ci-pull_request.yml b/.github/workflows/ci-pull_request.yml
index 46e41a19e1..8fe844fd87 100644
--- a/.github/workflows/ci-pull_request.yml
+++ b/.github/workflows/ci-pull_request.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: Check out the repo
@@ -75,7 +75,7 @@ jobs:
   unit-test:
     name: Unit Test
     if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: Check out the repo
@@ -117,7 +117,7 @@ jobs:
   unit-test-full:
     name: Unit Test (Full)
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: Check out the repo
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd25006b97..425d806779 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   init-hermit:
     name: Init Hermit Tools
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     steps:
       - name: Check out the repo
@@ -33,7 +33,7 @@ jobs:
   check-asset-inventory-supported-version:
     needs: [ init-hermit ]
     name: Check Asset Inventory supported version
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     outputs:
       asset_inventory_supported: ${{ steps.check-asset-inventory-supported-version.outputs.asset_inventory_supported }}
     steps:
@@ -60,7 +60,7 @@ jobs:
   ci-azure:
     needs: [ init-hermit ]
     name: CIS Azure CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: "read"
@@ -83,7 +83,7 @@ jobs:
   ci-azure-asset-inventory:
     needs: [ init-hermit, check-asset-inventory-supported-version ]
     name: Azure Asset Inventory CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     if: needs.check-asset-inventory-supported-version.outputs.asset_inventory_supported == 'true'
     timeout-minutes: 60
     permissions:
@@ -107,7 +107,7 @@ jobs:
   ci-aws:
     needs: [ init-hermit ]
     name: CIS AWS CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: "read"
@@ -130,7 +130,7 @@ jobs:
   ci-aws-asset-inventory:
     needs: [ init-hermit, check-asset-inventory-supported-version ]
     name: AWS Asset Inventory CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     if: needs.check-asset-inventory-supported-version.outputs.asset_inventory_supported == 'true'
     timeout-minutes: 60
     permissions:
@@ -153,7 +153,7 @@ jobs:
   ci-gcp:
     needs: [ init-hermit ]
     name: CIS GCP CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: 'read'
@@ -177,7 +177,7 @@ jobs:
   ci-gcp-asset-inventory:
     needs: [ init-hermit, check-asset-inventory-supported-version ]
     name: GCP Asset Inventory CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     if: needs.check-asset-inventory-supported-version.outputs.asset_inventory_supported == 'true'
     timeout-minutes: 60
     permissions:
@@ -201,7 +201,7 @@ jobs:
   ci-cnvm:
     needs: [ init-hermit ]
     name: CNVM CI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 75
     steps:
       - name: Free Disk Space (Ubuntu)
@@ -235,7 +235,7 @@ jobs:
     # Since we build the cloudbeat in the worker's OS and as non static,
     # we need to keep the OS version same as elastic-agent docker image base.
     # docker run --interactive --tty --rm --entrypoint bash docker.elastic.co/elastic-agent/elastic-agent-complete:9.3.2 -c 'cat /etc/os-release'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     steps:
       - name: Free Disk Space (Ubuntu)
@@ -263,7 +263,7 @@ jobs:
   ci-k8s:
     needs: [ init-hermit, docker-images ]
     name: ${{ matrix.test-target }}-${{ matrix.kind-config }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -330,7 +330,7 @@ jobs:
       - ci-cnvm
       - ci-k8s
     name: Upload integration tests results
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       pull-requests: write
diff --git a/.github/workflows/cloudformation-ci.yml b/.github/workflows/cloudformation-ci.yml
index 7b9d932205..36b0dd0480 100644
--- a/.github/workflows/cloudformation-ci.yml
+++ b/.github/workflows/cloudformation-ci.yml
@@ -25,7 +25,7 @@ env:
 jobs:
   Deploy-CloudFormation:
     name: "Deploy CloudFormation"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     defaults:
       run:
diff --git a/.github/workflows/destroy-environment.yml b/.github/workflows/destroy-environment.yml
index 5b7a8537fe..515fafd92a 100644
--- a/.github/workflows/destroy-environment.yml
+++ b/.github/workflows/destroy-environment.yml
@@ -41,7 +41,7 @@ env:
 
 jobs:
   Destroy:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120
     # Add "id-token" with the intended permissions.
     permissions:
diff --git a/.github/workflows/eks-ci.yml b/.github/workflows/eks-ci.yml
index 42c3108d60..493f5005d8 100644
--- a/.github/workflows/eks-ci.yml
+++ b/.github/workflows/eks-ci.yml
@@ -33,7 +33,7 @@ concurrency: EKS-Functional-Tests
 
 jobs:
   Setup:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     timeout-minutes: 40
@@ -55,7 +55,7 @@ jobs:
 
   Build:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - name: Check out the repo
@@ -133,7 +133,7 @@ jobs:
             k8s_context: "test-eks-config-2"
             label: "EKS functional tests: config 2"
     name: ${{ matrix.label }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 90
     steps:
       - name: Check out the repo
@@ -189,7 +189,7 @@ jobs:
     name: Publish Results
     needs: Test_Matrix
     if: always()
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Download Artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml
index 82932d4146..2e95fa35e4 100644
--- a/.github/workflows/packaging.yml
+++ b/.github/workflows/packaging.yml
@@ -30,7 +30,7 @@ concurrency:
 jobs:
   package_beat:
     name: Package Cloudbeat
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 40
     strategy:
       fail-fast: false
diff --git a/.github/workflows/publish-cloudformation.yml b/.github/workflows/publish-cloudformation.yml
index b3f263af9f..3339f1b356 100644
--- a/.github/workflows/publish-cloudformation.yml
+++ b/.github/workflows/publish-cloudformation.yml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   publish_cloudformation:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
diff --git a/.github/workflows/sync-rule-templates.yml b/.github/workflows/sync-rule-templates.yml
index 39ab9518a8..81b8cc33ab 100644
--- a/.github/workflows/sync-rule-templates.yml
+++ b/.github/workflows/sync-rule-templates.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   Sync-Templates:
     name: Sync CIS Rule Templates
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       id-token: write
diff --git a/.github/workflows/test-agent-compatibility.yml b/.github/workflows/test-agent-compatibility.yml
index ed5ef52898..4d2b27d485 100644
--- a/.github/workflows/test-agent-compatibility.yml
+++ b/.github/workflows/test-agent-compatibility.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   generate-matrix:
     name: Generate Agent Matrix
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -26,7 +26,7 @@ jobs:
 
   test-agents:
     name: Agent Compatibility Test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     needs: ["generate-matrix"]
     strategy:
diff --git a/.github/workflows/test-environment.yml b/.github/workflows/test-environment.yml
index 908c9c1a0e..94c5de6772 100644
--- a/.github/workflows/test-environment.yml
+++ b/.github/workflows/test-environment.yml
@@ -178,7 +178,7 @@ env:
 
 jobs:
   Deploy:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 120
     defaults:
       run:
diff --git a/.github/workflows/test-gcp-dm.yml b/.github/workflows/test-gcp-dm.yml
index 84a90165bb..3d37bce58f 100644
--- a/.github/workflows/test-gcp-dm.yml
+++ b/.github/workflows/test-gcp-dm.yml
@@ -34,7 +34,7 @@ jobs:
   # Test a GCP Deployment Manager deployment using Application Default Credentials
   gcp_dm_adc:
     name: CSPM GCP with ADC
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: "read"
@@ -129,7 +129,7 @@ jobs:
   gcp_dm_sa:
     needs: gcp_dm_adc
     name: CSPM GCP with SA
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 60
     permissions:
       contents: "read"
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 33f2d1fee8..2c6e04594d 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -25,7 +25,7 @@ jobs:
 
   manifest_tests:
     name: Manifest Tests
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - name: Check out the repo
diff --git a/.github/workflows/upgrade-environment.yml b/.github/workflows/upgrade-environment.yml
index 0387369cd2..d0cb86d0ab 100644
--- a/.github/workflows/upgrade-environment.yml
+++ b/.github/workflows/upgrade-environment.yml
@@ -41,7 +41,7 @@ env:
 
 jobs:
   init:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     outputs:
       base-stack-version: ${{ steps.set-previous-version.outputs.PREVIOUS_VERSION }}
       ess-region: ${{ env.TF_VAR_ess_region }}
@@ -88,7 +88,7 @@ jobs:
       serverless_mode: false
     secrets: inherit
   upgrade:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-26.04
     needs: [init, deploy]
     timeout-minutes: 120
     defaults: