diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d82b8101..1471235d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -258,8 +258,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # macOS 14 images were retired from GitHub Actions on 2026-11-02, so the
+          # arm64 legs use the same macOS 15 image as the SDK workflows.
           - arch: arm64
-            runs_on: macos-14
+            runs_on: macos-15
           - arch: x64
             runs_on: macos-15-intel
     steps:
@@ -326,6 +328,9 @@ jobs:
         uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           msystem: ${{ matrix.msystem }}
+          # MINGW64 is deprecated in MSYS2 but remains the supported GNU x64
+          # toolchain here; migrating to UCRT64 changes released binary runtimes.
+          suppress-deprecation-warnings: ${{ matrix.msystem == 'MINGW64' && 'msystem-mingw64' || '' }}
           update: true
           install: >-
             make
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d4bbcde6..3d924e75 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,7 +20,9 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    # Pin the image so the announced ubuntu-latest -> Ubuntu 26 migration cannot
+    # change the documentation build under us.
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -50,9 +52,13 @@ jobs:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: build
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+        with:
+          # Pages commonly needs more than the 10 minute default to finish an
+          # `updating_pages` deployment; aborting it only cancels the deployment.
+          timeout: 1200000
diff --git a/.github/workflows/python-sdk.yml b/.github/workflows/python-sdk.yml
index e5ae8ba2..90b3824a 100644
--- a/.github/workflows/python-sdk.yml
+++ b/.github/workflows/python-sdk.yml
@@ -130,6 +130,9 @@ jobs:
         if: runner.os == 'Windows'
         with:
           msystem: ${{ matrix.msystem }}
+          # MINGW64 is deprecated in MSYS2 but remains the supported GNU x64
+          # toolchain here; migrating to UCRT64 changes released binary runtimes.
+          suppress-deprecation-warnings: ${{ matrix.msystem == 'MINGW64' && 'msystem-mingw64' || '' }}
           path-type: inherit
           update: true
           install: ${{ matrix.packages }} make git perl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 03dbd7a9..009786fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -327,7 +327,8 @@ jobs:
   macos-arm64:
     name: macOS arm64
     needs: [validate-release]
-    runs-on: macos-14
+    # macOS 14 images were retired from GitHub Actions on 2026-11-02.
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -386,6 +387,9 @@ jobs:
         uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           msystem: ${{ matrix.msystem }}
+          # MINGW64 is deprecated in MSYS2 but remains the supported GNU x64
+          # toolchain here; migrating to UCRT64 changes released binary runtimes.
+          suppress-deprecation-warnings: ${{ matrix.msystem == 'MINGW64' && 'msystem-mingw64' || '' }}
           update: true
           install: >-
             make
diff --git a/.github/workflows/wizard.yml b/.github/workflows/wizard.yml
index c07a1597..31d855bb 100644
--- a/.github/workflows/wizard.yml
+++ b/.github/workflows/wizard.yml
@@ -34,7 +34,8 @@ env:
 jobs:
   wizard:
     name: Native wizard (macOS arm64)
-    runs-on: macos-14
+    # macOS 14 images were retired from GitHub Actions on 2026-11-02.
+    runs-on: macos-15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
diff --git a/scripts/tests/test_ci_workflows.py b/scripts/tests/test_ci_workflows.py
index 766f95f5..1cf5af60 100644
--- a/scripts/tests/test_ci_workflows.py
+++ b/scripts/tests/test_ci_workflows.py
@@ -49,7 +49,7 @@ def test_gui_remains_opt_in_with_explicit_headless_ui_test_support(self):
 
     def test_default_macos_ci_keeps_both_architectures_without_gui_builds(self):
         macos = job(self.ci, "macos")
-        for contract in ("arch: arm64", "runs_on: macos-14", "arch: x64",
+        for contract in ("arch: arm64", "runs_on: macos-15", "arch: x64",
                          "runs_on: macos-15-intel", "run: make tests"):
             with self.subTest(contract=contract):
                 self.assertIn(contract, macos)
@@ -80,7 +80,7 @@ def test_optional_wizard_runs_once_with_all_existing_native_regressions(self):
         jobs = section(self.wizard, "jobs")
         self.assertEqual(re.findall(r"(?m)^  ([\w-]+):$", jobs), ["wizard"])
         wizard = job(self.wizard, "wizard")
-        self.assertIn("runs-on: macos-14", wizard)
+        self.assertIn("runs-on: macos-15", wizard)
         self.assertNotIn("matrix:", wizard)
         self.assertIn(
             "cargo test --locked -p kingfisher-bin --features gui-tests --lib wizard::",