diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2a5e7796..cf6b09474 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,9 @@ concurrency:
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    # Pinned: ubuntu-latest (26.04) ships mariadb-client 11.8, which requires
+    # SSL by default and cannot talk to the mariadb:10.6 service container.
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
     name: Server