diff --git a/.github/workflows/azure-static-web-apps.yml b/.github/workflows/azure-static-web-apps.yml
index 4a6e8a2f5..8fc3d2cff 100644
--- a/.github/workflows/azure-static-web-apps.yml
+++ b/.github/workflows/azure-static-web-apps.yml
@@ -39,7 +39,7 @@ jobs:
       github.event.action != 'closed' &&
       github.event.pull_request.head.repo.full_name == github.repository)
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout
@@ -115,7 +115,7 @@ jobs:
       github.event.action != 'closed' &&
       github.event.pull_request.head.repo.full_name == github.repository)
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Download WASM app
@@ -142,7 +142,7 @@ jobs:
       github.event.action == 'closed' &&
       github.event.pull_request.head.repo.full_name == github.repository
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Close Azure Static Web Apps environment
diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml
index cec39e75f..4e553b523 100644
--- a/.github/workflows/conventional-commits.yml
+++ b/.github/workflows/conventional-commits.yml
@@ -14,7 +14,7 @@ env:
 jobs:
   commitsar:
     name: Validate Conventional Commits
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     steps:
       - uses: actions/checkout@v1
diff --git a/build/stage-build-desktop.yml b/build/stage-build-desktop.yml
index 61131b4b5..cbaacd88c 100644
--- a/build/stage-build-desktop.yml
+++ b/build/stage-build-desktop.yml
@@ -5,7 +5,7 @@ jobs:
   container: unoplatform/wasm-build:3.0
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   strategy:
     matrix:
@@ -35,6 +35,8 @@ jobs:
     clean: 'true'
 
   - template: templates/host-cleanup-linux.yml
+    parameters:
+      target: host
 
   - template: templates/dotnet-install-linux.yml
     parameters:
diff --git a/build/stage-build-wasm.yml b/build/stage-build-wasm.yml
index 521bf0112..a78b21e99 100644
--- a/build/stage-build-wasm.yml
+++ b/build/stage-build-wasm.yml
@@ -5,7 +5,7 @@ jobs:
   container: unoplatform/wasm-build:3.0
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   strategy:
     matrix:
@@ -31,6 +31,8 @@ jobs:
     clean: 'true'
 
   - template: templates/host-cleanup-linux.yml
+    parameters:
+      target: host
 
   - template: templates/dotnet-install-linux.yml
     parameters:
diff --git a/build/stage-code-style.yml b/build/stage-code-style.yml
index 3e1797eae..6c4629262 100644
--- a/build/stage-code-style.yml
+++ b/build/stage-code-style.yml
@@ -5,7 +5,7 @@ jobs:
   container: unoplatform/wasm-build:3.0
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   variables:
     # dotnet format has no -p: switch, so the single-platform override is passed as an
diff --git a/build/stage-conflict-markers.yml b/build/stage-conflict-markers.yml
index 5a1ea34ab..065a0c25d 100644
--- a/build/stage-conflict-markers.yml
+++ b/build/stage-conflict-markers.yml
@@ -8,7 +8,7 @@ jobs:
   displayName: No unresolved merge conflicts
   cancelTimeoutInMinutes: 0
   pool:
-    vmImage: ubuntu-latest
+    vmImage: ubuntu-24.04
   steps:
   - checkout: self
     fetchDepth: 1
diff --git a/build/stage-determine-changes.yml b/build/stage-determine-changes.yml
index 8b260003a..4617480e1 100644
--- a/build/stage-determine-changes.yml
+++ b/build/stage-determine-changes.yml
@@ -3,7 +3,7 @@ jobs:
   cancelTimeoutInMinutes: 0
   displayName: 'Check for Doc Only Changes'
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
   steps:
   - powershell: |
       # Determine the context of the build (PR or push) and set the target branch accordingly
diff --git a/build/stage-docs-validations.yml b/build/stage-docs-validations.yml
index 113a2e637..1bde4387b 100644
--- a/build/stage-docs-validations.yml
+++ b/build/stage-docs-validations.yml
@@ -4,7 +4,7 @@
   displayName: 'Spell Checking Validation'
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   steps:
   - checkout: self
@@ -29,7 +29,7 @@
   displayName: 'Markdown Validation'
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   steps:
   - checkout: self
@@ -51,7 +51,7 @@
   displayName: 'Style Docs Validation'
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   steps:
   - checkout: self
diff --git a/build/stage-runtimetests-desktop.yml b/build/stage-runtimetests-desktop.yml
index bd21f6eb4..1bb2bdee1 100644
--- a/build/stage-runtimetests-desktop.yml
+++ b/build/stage-runtimetests-desktop.yml
@@ -5,7 +5,7 @@ jobs:
   timeoutInMinutes: 60
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   strategy:
     matrix:
@@ -73,7 +73,7 @@ jobs:
   timeoutInMinutes: 30
 
   pool:
-    vmImage: 'ubuntu-latest'
+    vmImage: 'ubuntu-24.04'
 
   steps:
   - checkout: self
diff --git a/build/templates/host-cleanup-linux.yml b/build/templates/host-cleanup-linux.yml
index 59b21140b..8bed82e38 100644
--- a/build/templates/host-cleanup-linux.yml
+++ b/build/templates/host-cleanup-linux.yml
@@ -1,7 +1,19 @@
 # Reusable AzDO template: Cleanup unused dependencies on Linux CI agents.
 # Calls the shared host-cleanup-linux.sh script to avoid duplication with GitHub Actions.
+#
+# Parameters:
+#   target - set to 'host' when the job runs in a container, so the cleanup runs
+#            on the host VM, where the removed paths exist. Inside the container
+#            it frees nothing.
+parameters:
+  - name: target
+    type: string
+    default: ''
+
 steps:
   - bash: |
       bash "$(Build.SourcesDirectory)/build/scripts/host-cleanup-linux.sh"
     displayName: Cleanup unused host dependencies
-    condition: eq(variables['Agent.OS'], 'Linux')
\ No newline at end of file
+    condition: eq(variables['Agent.OS'], 'Linux')
+    ${{ if ne(parameters.target, '') }}:
+      target: ${{ parameters.target }}
\ No newline at end of file