diff --git a/.github/workflows/CHANGELOGS/deploy_environment.md b/.github/workflows/CHANGELOGS/deploy_environment.md
index 6464a6b..92959f0 100644
--- a/.github/workflows/CHANGELOGS/deploy_environment.md
+++ b/.github/workflows/CHANGELOGS/deploy_environment.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **deploy_environment** reusable workflow are documented in this file.
 
+## 0.2.0
+
+### Changed
+
+- Updated the composed Terraform plan and apply jobs from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/deploy_thru_prod.md b/.github/workflows/CHANGELOGS/deploy_thru_prod.md
index 100c8de..3210c58 100644
--- a/.github/workflows/CHANGELOGS/deploy_thru_prod.md
+++ b/.github/workflows/CHANGELOGS/deploy_thru_prod.md
@@ -2,6 +2,13 @@
 
 All notable changes to the **deploy_thru_prod** reusable workflow are documented in this file.
 
+## 0.2.0
+
+### Changed
+
+- Updated the workflow's jobs and composed environment-deployment chain from Ubuntu 24.04 to
+  Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/run_semgrep_scan.md b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
index 982c4d7..7d71068 100644
--- a/.github/workflows/CHANGELOGS/run_semgrep_scan.md
+++ b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **run_semgrep_scan** callable workflow are documented in this file.
 
+## 1.2.0
+
+### Changed
+
+- Updated the workflow job from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 1.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/run_sonar_scan.md b/.github/workflows/CHANGELOGS/run_sonar_scan.md
index 81004b2..75de097 100644
--- a/.github/workflows/CHANGELOGS/run_sonar_scan.md
+++ b/.github/workflows/CHANGELOGS/run_sonar_scan.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **run_sonar_scan** callable workflow are documented in this file.
 
+## 1.2.0
+
+### Changed
+
+- Updated the workflow job from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 1.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/tf_apply.md b/.github/workflows/CHANGELOGS/tf_apply.md
index 26f06d8..b8ecf29 100644
--- a/.github/workflows/CHANGELOGS/tf_apply.md
+++ b/.github/workflows/CHANGELOGS/tf_apply.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **tf_apply** reusable workflow are documented in this file.
 
+## 0.2.0
+
+### Changed
+
+- Updated workflow jobs from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/tf_validate_plan_env_roots.md b/.github/workflows/CHANGELOGS/tf_validate_plan_env_roots.md
index a2e74a9..472d8ce 100644
--- a/.github/workflows/CHANGELOGS/tf_validate_plan_env_roots.md
+++ b/.github/workflows/CHANGELOGS/tf_validate_plan_env_roots.md
@@ -3,6 +3,12 @@
 All notable changes to the **tf_validate_plan_env_roots** reusable workflow are documented in this
 file.
 
+## 0.2.0
+
+### Changed
+
+- Updated the composed environment plan jobs from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/tf_validate_plan_single_root.md b/.github/workflows/CHANGELOGS/tf_validate_plan_single_root.md
index 4b2f154..4f11166 100644
--- a/.github/workflows/CHANGELOGS/tf_validate_plan_single_root.md
+++ b/.github/workflows/CHANGELOGS/tf_validate_plan_single_root.md
@@ -3,6 +3,12 @@
 All notable changes to the **tf_validate_plan_single_root** reusable workflow are documented in
 this file.
 
+## 0.2.0
+
+### Changed
+
+- Updated the workflow job from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/CHANGELOGS/trigger_workflow_and_wait.md b/.github/workflows/CHANGELOGS/trigger_workflow_and_wait.md
index 08c4e80..2941253 100644
--- a/.github/workflows/CHANGELOGS/trigger_workflow_and_wait.md
+++ b/.github/workflows/CHANGELOGS/trigger_workflow_and_wait.md
@@ -3,6 +3,12 @@
 All notable changes to the **trigger_workflow_and_wait** reusable workflow are documented in this
 file.
 
+## 0.2.0
+
+### Changed
+
+- Updated the workflow job from Ubuntu 24.04 to Ubuntu 26.04.
+
 ## 0.1.0
 
 ### Changed
diff --git a/.github/workflows/READMES/deploy_environment.md b/.github/workflows/READMES/deploy_environment.md
index 993daaf..5e7c47d 100644
--- a/.github/workflows/READMES/deploy_environment.md
+++ b/.github/workflows/READMES/deploy_environment.md
@@ -20,7 +20,7 @@ successful plan.
 ```yaml
 jobs:
   deploy-dev:
-    uses: OpenSesame/core-github-actions/.github/workflows/deploy_environment.yml@workflows/deploy_environment/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/deploy_environment.yml@workflows/deploy_environment/0.2.0
     with:
       environment: dev
       commit-identifier: ${{ github.sha }}
@@ -61,7 +61,7 @@ jobs:
 
 Runs for the same repository and environment share a concurrency group. The workflow declares
 `id-token: write` and `contents: read` permissions for its called workflows.
-The composed plan and apply jobs run on Ubuntu 24.04.
+The composed plan and apply jobs run on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/deploy_thru_prod.md b/.github/workflows/READMES/deploy_thru_prod.md
index 80ca78f..3e93d5e 100644
--- a/.github/workflows/READMES/deploy_thru_prod.md
+++ b/.github/workflows/READMES/deploy_thru_prod.md
@@ -20,7 +20,7 @@ GitHub release, and posts the final stage, prod, and release status to the assoc
 ```yaml
 jobs:
   deploy-through-prod:
-    uses: OpenSesame/core-github-actions/.github/workflows/deploy_thru_prod.yml@workflows/deploy_thru_prod/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/deploy_thru_prod.yml@workflows/deploy_thru_prod/0.2.0
     with:
       commit-identifier: ${{ github.sha }}
       oidc-domain: core
@@ -63,7 +63,7 @@ The release-tag job only runs when the caller's event is a merged pull request o
 the same repository share one concurrency group.
 
 The workflow requests `id-token: write`, `contents: write`, and `pull-requests: write` permissions.
-Its direct and composed jobs run on Ubuntu 24.04.
+Its direct and composed jobs run on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/run_semgrep_scan.md b/.github/workflows/READMES/run_semgrep_scan.md
index e04d443..aac2a5e 100644
--- a/.github/workflows/READMES/run_semgrep_scan.md
+++ b/.github/workflows/READMES/run_semgrep_scan.md
@@ -58,7 +58,7 @@ The workflow provides the following outputs for use in downstream jobs or for re
 
 Findings are also posted as PR comments and Reviewdog annotations (if enabled), and a summary is written to the GitHub Actions job summary.
 
-The workflow job runs on Ubuntu 24.04.
+The workflow job runs on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/run_sonar_scan.md b/.github/workflows/READMES/run_sonar_scan.md
index 0be8347..b3acdf1 100644
--- a/.github/workflows/READMES/run_sonar_scan.md
+++ b/.github/workflows/READMES/run_sonar_scan.md
@@ -11,7 +11,7 @@ The consuming repository must include its SonarQube configuration, such as a `so
 ```yaml
 jobs:
   sonar-scan:
-    uses: OpenSesame/core-github-actions/.github/workflows/run_sonar_scan.yml@workflows/run_sonar_scan/1.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/run_sonar_scan.yml@workflows/run_sonar_scan/1.2.0
     secrets:
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 ```
@@ -35,7 +35,7 @@ with:
 | ------------- | -------- | ---------------------------------------------- |
 | `SONAR_TOKEN` | Yes      | Token used to authenticate the SonarQube scan. |
 
-The workflow job runs on Ubuntu 24.04.
+The workflow job runs on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/tf_apply.md b/.github/workflows/READMES/tf_apply.md
index 01fabbe..425cfc5 100644
--- a/.github/workflows/READMES/tf_apply.md
+++ b/.github/workflows/READMES/tf_apply.md
@@ -19,7 +19,7 @@ GitHub environment and Terraform workspace.
 ```yaml
 jobs:
   terraform-apply:
-    uses: OpenSesame/core-github-actions/.github/workflows/tf_apply.yml@workflows/tf_apply/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/tf_apply.yml@workflows/tf_apply/0.2.0
     with:
       environment: dev
       oidc-domain: core
@@ -65,7 +65,7 @@ jobs:
 The apply job sets `TF_VAR_IACDeploymentRef` to the current Actions run URL and
 `TF_VAR_release_name` to `release-tag`. Runs for the same repository and environment share a
 concurrency group. The workflow requests `id-token: write` and `contents: read` permissions.
-Both workflow jobs run on Ubuntu 24.04.
+Both workflow jobs run on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/tf_validate_plan_env_roots.md b/.github/workflows/READMES/tf_validate_plan_env_roots.md
index edaef89..bcf11f7 100644
--- a/.github/workflows/READMES/tf_validate_plan_env_roots.md
+++ b/.github/workflows/READMES/tf_validate_plan_env_roots.md
@@ -19,7 +19,7 @@ workflow.
 ```yaml
 jobs:
   terraform-plans:
-    uses: OpenSesame/core-github-actions/.github/workflows/tf_validate_plan_env_roots.yml@workflows/tf_validate_plan_env_roots/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/tf_validate_plan_env_roots.yml@workflows/tf_validate_plan_env_roots/0.2.0
     with:
       commit-identifier: ${{ github.sha }}
       oidc-domain: core
@@ -54,7 +54,7 @@ jobs:
 - Uses the supplied `terraform-workspace` for every environment when present; otherwise uses the
   environment name.
 - Does not request plan artifacts from the called workflow.
-- Runs the composed plan jobs on Ubuntu 24.04.
+- Runs the composed plan jobs on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/tf_validate_plan_single_root.md b/.github/workflows/READMES/tf_validate_plan_single_root.md
index 6546c02..46a3de8 100644
--- a/.github/workflows/READMES/tf_validate_plan_single_root.md
+++ b/.github/workflows/READMES/tf_validate_plan_single_root.md
@@ -20,7 +20,7 @@ optionally upload the rendered plan as an artifact.
 ```yaml
 jobs:
   terraform-plan:
-    uses: OpenSesame/core-github-actions/.github/workflows/tf_validate_plan_single_root.yml@workflows/tf_validate_plan_single_root/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/tf_validate_plan_single_root.yml@workflows/tf_validate_plan_single_root/0.2.0
     with:
       environment: dev
       oidc-domain: core
@@ -80,7 +80,7 @@ When enabled, artifact upload looks for `terraform/<environment>/tfplan.txt`, re
 8. Optionally uploads the rendered plan text for seven days.
 
 Runs for the same repository and environment share a concurrency group. The job requests
-`id-token: write` and `contents: read` permissions and runs on Ubuntu 24.04.
+`id-token: write` and `contents: read` permissions and runs on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/READMES/trigger_workflow_and_wait.md b/.github/workflows/READMES/trigger_workflow_and_wait.md
index a538e91..574f173 100644
--- a/.github/workflows/READMES/trigger_workflow_and_wait.md
+++ b/.github/workflows/READMES/trigger_workflow_and_wait.md
@@ -19,7 +19,7 @@ the resulting run, waits for completion, and exposes the downstream run details
 ```yaml
 jobs:
   downstream:
-    uses: OpenSesame/core-github-actions/.github/workflows/trigger_workflow_and_wait.yml@workflows/trigger_workflow_and_wait/0.1.0
+    uses: OpenSesame/core-github-actions/.github/workflows/trigger_workflow_and_wait.yml@workflows/trigger_workflow_and_wait/0.2.0
     with:
       owner: OpenSesame
       repo: example-service
@@ -68,7 +68,7 @@ jobs:
 Run discovery selects the newest run ID that appears after dispatch. The completion polling loop has
 no independent maximum duration; it waits as long as the downstream run remains incomplete. The
 workflow requests `id-token: write` and `contents: read` permissions in the caller repository.
-The workflow job runs on Ubuntu 24.04.
+The workflow job runs on Ubuntu 26.04.
 
 ## Contribution
 
diff --git a/.github/workflows/deploy_thru_prod.yml b/.github/workflows/deploy_thru_prod.yml
index 756eda5..277924a 100644
--- a/.github/workflows/deploy_thru_prod.yml
+++ b/.github/workflows/deploy_thru_prod.yml
@@ -47,7 +47,7 @@ permissions:
 
 jobs:
   Set-Release-Tag:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     if: ${{ github.event.pull_request.merged || github.event_name == 'workflow_dispatch' }}
     outputs:
       release-tag: ${{ steps.releaseTag.outputs.release-tag }}
@@ -108,7 +108,7 @@ jobs:
   CreateRelease:
     name: Create New Release
     needs: [Set-Release-Tag, DeployProd]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Checkout Actions
@@ -126,7 +126,7 @@ jobs:
 
   ReportStatus:
     name: Report Status on PR
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: [DeployDev, DeployStage, DeployProd, CreateRelease]
     if: always()
     env:
diff --git a/.github/workflows/internal_on_merge_tag_versions.yml b/.github/workflows/internal_on_merge_tag_versions.yml
index 5100b71..5b3a58d 100644
--- a/.github/workflows/internal_on_merge_tag_versions.yml
+++ b/.github/workflows/internal_on_merge_tag_versions.yml
@@ -11,7 +11,7 @@ permissions:
 jobs:
   no-merge:
     if: github.event.pull_request.merged == false
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: No Merge Detected
         run: |
@@ -21,7 +21,7 @@ jobs:
 
   set-version-tags:
     if: github.event.pull_request.merged == true
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/internal_on_pr_validate_component_version.yml b/.github/workflows/internal_on_pr_validate_component_version.yml
index 4c69d68..fde82de 100644
--- a/.github/workflows/internal_on_pr_validate_component_version.yml
+++ b/.github/workflows/internal_on_pr_validate_component_version.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   validate-version-labels:
     name: Validate PR Version Labels
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Checkout repo
diff --git a/.github/workflows/internal_on_push_ci.yml b/.github/workflows/internal_on_push_ci.yml
index 0659c54..4468d2e 100644
--- a/.github/workflows/internal_on_push_ci.yml
+++ b/.github/workflows/internal_on_push_ci.yml
@@ -14,7 +14,7 @@ permissions:
 jobs:
   internal-ci:
     name: Internal CI
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Checkout repo
diff --git a/.github/workflows/run_semgrep_scan.yml b/.github/workflows/run_semgrep_scan.yml
index 4781022..57c4fcb 100644
--- a/.github/workflows/run_semgrep_scan.yml
+++ b/.github/workflows/run_semgrep_scan.yml
@@ -125,7 +125,7 @@ concurrency:
 jobs:
   semgrep:
     name: Run Semgrep
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     outputs:
       total_findings: ${{ steps.semgrep.outputs.totalFindings }}
diff --git a/.github/workflows/run_sonar_scan.yml b/.github/workflows/run_sonar_scan.yml
index f2239d1..e9183b5 100644
--- a/.github/workflows/run_sonar_scan.yml
+++ b/.github/workflows/run_sonar_scan.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   sonar-scan:
     name: Run SonarQube scan
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/tf_apply.yml b/.github/workflows/tf_apply.yml
index 05ee0fb..8e4c3d3 100644
--- a/.github/workflows/tf_apply.yml
+++ b/.github/workflows/tf_apply.yml
@@ -51,7 +51,7 @@ env:
 
 jobs:
   Summary:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Markdown Summary
         run: |
@@ -67,7 +67,7 @@ jobs:
 
   TF-Apply:
     name: Terraform Apply
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     environment: ${{ inputs.environment}}
     defaults:
       run:
diff --git a/.github/workflows/tf_validate_plan_single_root.yml b/.github/workflows/tf_validate_plan_single_root.yml
index 6c6a6e5..1f23707 100644
--- a/.github/workflows/tf_validate_plan_single_root.yml
+++ b/.github/workflows/tf_validate_plan_single_root.yml
@@ -63,7 +63,7 @@ env:
 jobs:
   TF-Validate-Plan:
     name: Terraform Validate and Plan ${{ inputs.environment }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     environment: ${{ inputs.environment }}
     defaults: # runs all steps in this directory
       run:
diff --git a/.github/workflows/trigger_workflow_and_wait.yml b/.github/workflows/trigger_workflow_and_wait.yml
index f5e0c47..866c6a2 100644
--- a/.github/workflows/trigger_workflow_and_wait.yml
+++ b/.github/workflows/trigger_workflow_and_wait.yml
@@ -44,7 +44,7 @@ permissions:
 
 jobs:
   trigger:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     outputs:
       downstream_run_id: ${{ steps.run.outputs.downstream_run_id }}
       downstream_html_url: ${{ steps.run.outputs.downstream_html_url }}
diff --git a/.nvmrc b/.nvmrc
index 5bf4400..df6ae33 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-24.15.0
+24.21.0
diff --git a/semgrep/README.md b/semgrep/README.md
index 3e88a9a..76638de 100644
--- a/semgrep/README.md
+++ b/semgrep/README.md
@@ -143,7 +143,7 @@ permissions:
 
 jobs:
   security:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4