diff --git a/.github/workflows/_container.yml b/.github/workflows/_container.yml
index 0b906c2e0..43fe91568 100644
--- a/.github/workflows/_container.yml
+++ b/.github/workflows/_container.yml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   container:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     env:
       CPR_IMAGE: codex-proxy-rs:ci-${{ inputs.ref }}
diff --git a/.github/workflows/_quality.yml b/.github/workflows/_quality.yml
index e49248184..894bc9464 100644
--- a/.github/workflows/_quality.yml
+++ b/.github/workflows/_quality.yml
@@ -24,7 +24,7 @@ permissions:
 jobs:
   backend:
     if: inputs.run_backend
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     env:
       CARGO_TERM_COLOR: always
@@ -34,7 +34,7 @@ jobs:
       CPR_TEST_REDIS_URL: redis://127.0.0.1:6379
     services:
       postgres:
-        image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
+        image: postgres:18-bookworm@sha256:bbf83594798e144bff365a9c191c5d779f181fb3135902064ab8ff11918020fc
         env:
           POSTGRES_DB: codex_proxy
           POSTGRES_USER: codex_proxy
@@ -48,7 +48,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
       redis:
-        image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
+        image: redis:8-alpine@sha256:0bf6577d7774e592b29d093e3ac9390eb91e13d72c21e506afce736de5e0eeb0
         ports:
           - 6379:6379
         options: >-
@@ -199,7 +199,7 @@ jobs:
 
   frontend:
     if: inputs.run_frontend
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       CI: 'true'
@@ -213,7 +213,7 @@ jobs:
         uses: ./.github/actions/build-frontend
 
   workflow-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Checkout
@@ -223,6 +223,8 @@ jobs:
 
       # GitHub 已支持 queue: max，actionlint 尚未支持该字段
       # https://github.com/rhysd/actionlint/issues/657
+      # GitHub 已提供 ubuntu-26.04，actionlint 尚未收录该标签
+      # https://github.com/actions/runner-images#available-images
       - name: Lint GitHub Actions workflows
         run: >-
           docker run --rm
@@ -231,6 +233,7 @@ jobs:
           rhysd/actionlint:1.7.7@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
           -color
           -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$'
+          -ignore '^label "ubuntu-26\.04" is unknown\.'
           .github/workflows/*.yml
 
       - name: Check workflow script syntax
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a1ff68ac6..b02562792 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   changes:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     permissions:
       contents: read
@@ -105,7 +105,7 @@ jobs:
   source-development:
     needs: changes
     if: needs.changes.outputs.source == 'true'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Checkout with development modules
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c988a5381..7e2a85800 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ env:
 
 jobs:
   release-info:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     outputs:
       tag: ${{ steps.version.outputs.tag }}
@@ -73,7 +73,7 @@ jobs:
 
   frontend:
     needs: release-info
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     env:
       CI: 'true'
@@ -205,7 +205,7 @@ jobs:
 
   package-assets:
     needs: [release-info, frontend, build-docker-binary, build-binary]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: read
@@ -375,7 +375,7 @@ jobs:
       queue: max
     # 产物准备可与测试重叠，版本标签和 GitHub Release 必须等全部质量与镜像验证通过
     needs: [release-info, quality, package-assets, build-docker-image]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     permissions:
       contents: write
diff --git a/.github/workflows/rules.yml b/.github/workflows/rules.yml
index 67e505eaa..fe4b83ad4 100644
--- a/.github/workflows/rules.yml
+++ b/.github/workflows/rules.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   guard:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       # 只查询 PR 元数据，禁止检出或执行贡献分支中的代码。
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 1050c15bf..fe4408c40 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -19,7 +19,7 @@ concurrency:
 
 jobs:
   backend-security:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - name: Checkout
@@ -38,7 +38,7 @@ jobs:
           cargo-audit audit --file backend/Cargo.lock
 
   frontend-security:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - name: Checkout
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index b9a239484..4bd3f39cb 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -2,9 +2,9 @@
 
 # PostgreSQL 服务端镜像：备份客户端（pg_dump/pg_restore）从这里取，与 compose 同源、
 # 版本严格一致。升级数据库版本时只需同步修改这里与 deploy/compose.yaml。
-ARG POSTGRES_IMAGE=postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
+ARG POSTGRES_IMAGE=postgres:18-bookworm@sha256:bbf83594798e144bff365a9c191c5d779f181fb3135902064ab8ff11918020fc
 
-FROM node:26.12.0-bookworm-slim@sha256:298992629d69bbd5b2b03ad57094d8e4fcb3a8eeb7c4e25d29de656519568913 AS frontend-builder
+FROM node:26.12.1-bookworm-slim@sha256:28147155d47dc31abe0a46e0d12b59b2fb3d0a2dcc5dc65fce76a074180b16fe AS frontend-builder
 
 WORKDIR /app/frontend
 COPY frontend/package.json frontend/pnpm-lock.yaml frontend/pnpm-workspace.yaml ./
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
index 30fc8bf94..4e22a5be3 100644
--- a/deploy/compose.yaml
+++ b/deploy/compose.yaml
@@ -11,7 +11,7 @@ services:
     extends:
       file: config.yaml
       service: postgres-credentials
-    image: postgres:18-bookworm@sha256:d9c83446333daec3f0588cc709adb80c26090b7f9f0f7ec8d43c243385d79818
+    image: postgres:18-bookworm@sha256:bbf83594798e144bff365a9c191c5d779f181fb3135902064ab8ff11918020fc
     restart: unless-stopped
     command:
       - postgres
@@ -45,7 +45,7 @@ services:
     extends:
       file: config.yaml
       service: redis-credentials
-    image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
+    image: redis:8-alpine@sha256:0bf6577d7774e592b29d093e3ac9390eb91e13d72c21e506afce736de5e0eeb0
     restart: unless-stopped
     volumes:
       - type: bind
diff --git a/docs/development.md b/docs/development.md
index 8d671d66a..2f6ab9916 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -14,7 +14,7 @@
 
 ## 环境与依赖
 
-需要 Node.js 26.12.0、pnpm、[Rust 工具链](architecture.md#验证命令)、PostgreSQL 和 Redis
+需要 Node.js 26.12.1、pnpm、[Rust 工具链](architecture.md#验证命令)、PostgreSQL 和 Redis
 
 各前端的 `packageManager` 固定 pnpm 版本，宿主 CI 和 Docker 从 `frontend/package.json` 读取
 
diff --git a/release/platforms.yaml b/release/platforms.yaml
index e2cec6dc8..7c9202066 100644
--- a/release/platforms.yaml
+++ b/release/platforms.yaml
@@ -1,7 +1,7 @@
 platforms:
   - os: linux
     arch: amd64
-    runner: ubuntu-latest
+    runner: ubuntu-26.04
     target: x86_64-unknown-linux-gnu
     binary: codex-proxy-rs
     archive: tar.gz