diff --git a/.github/workflows/check-release.yml b/.github/workflows/check-release.yml
index 3998c6b..af2d140 100644
--- a/.github/workflows/check-release.yml
+++ b/.github/workflows/check-release.yml
@@ -5,7 +5,7 @@ on: [workflow_call]
 
 jobs:
   check-release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/common-ci.yml b/.github/workflows/common-ci.yml
index 7eff465..6d63c21 100644
--- a/.github/workflows/common-ci.yml
+++ b/.github/workflows/common-ci.yml
@@ -2,21 +2,21 @@ on: [workflow_call]
 
 jobs:
   buildifier:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
       - name: Install
         run: |
-          BUILDIFIER_URL=https://github.com/bazelbuild/buildtools/releases/download/v6.1.2/buildifier-linux-amd64
+          BUILDIFIER_URL=https://github.com/bazelbuild/buildtools/releases/download/v7.3.1/buildifier-linux-amd64
           wget --retry-connrefused --waitretry=1 --read-timeout=20 --timeout=15 -t 3 -O buildifier "$BUILDIFIER_URL"
           chmod +x buildifier
       - name: Check
         run: ./buildifier --lint=warn --warnings=all -mode diff $(find . -type f -name "WORKSPACE" -or -name "BUILD.*")
 
   restyled:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: restyled-io/actions/setup@v4
diff --git a/.github/workflows/haskell-ci.yml b/.github/workflows/haskell-ci.yml
index 2bbdf03..4ddb2e8 100644
--- a/.github/workflows/haskell-ci.yml
+++ b/.github/workflows/haskell-ci.yml
@@ -2,7 +2,7 @@ on: [workflow_call]
 
 jobs:
   stack:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container: toxchat/toktok-stack:haskell
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/haskell-publish.yml b/.github/workflows/haskell-publish.yml
index a23d57c..0e0afab 100644
--- a/.github/workflows/haskell-publish.yml
+++ b/.github/workflows/haskell-publish.yml
@@ -19,7 +19,7 @@ on:
 
 jobs:
   docker:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -37,7 +37,7 @@ jobs:
 
   hackage:
     name: Publish to Hackage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 05f8ac5..11c5160 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -14,7 +14,7 @@ jobs:
       # write permission is required for autolabeler
       # otherwise, read permission is required at least
       pull-requests: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
       - uses: release-drafter/release-drafter@v6