@@ -32,7 +32,7 @@ jobs:
     # container action that would otherwise sit behind the toolchain setup the
     # build job spends its first half-minute on.
     name: License header
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
@@ -48,7 +48,7 @@ jobs:
     # the setup cost eight times over. Steps run cheapest-first so a lint or
     # type error reports before the package build starts.
     name: Build and check
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
@@ -252,7 +252,7 @@ jobs:
     # `test/e2e/script/env` pins, on an ephemeral port, and stops it after. No
     # service container to declare and no port to collide with.
     name: BanyanDB client IT
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
@@ -278,7 +278,7 @@ jobs:
     if: always() && !cancelled()
     name: Required
     needs: [license-header, build-and-check, banyandb-client-it]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     steps:
       - name: Check upstream jobs
 
@@ -225,10 +225,7 @@ concurrency:
 jobs:
   e2e:
     name: ${{ matrix.case.name }}
-    # Not ubuntu-latest: on ubuntu-26.04, kind cannot load the multi-platform
-    # OAP image into its node (`ctr images import --all-platforms`: content
-    # digest not found), so the kind cases fail before any test runs.
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     strategy:
       # One case failing must not cancel the others: when several go red at
@@ -292,7 +289,7 @@ jobs:
         run: make -C test/e2e images
 
       - name: ${{ matrix.case.name }}
-        uses: apache/skywalking-infra-e2e@68bbdec303cf2d3df9f2353f970f91938b52f674
+        uses: apache/skywalking-infra-e2e@ed91851a723f7d09e99742f28835ee91758e0c2b
         with:
           e2e-file: $GITHUB_WORKSPACE/${{ matrix.case.config }}
           # Container logs land here. On a red run they answer the first
@@ -330,7 +327,7 @@ jobs:
     name: E2E Required
     if: always() && !cancelled()
     needs: [e2e]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     steps:
       - name: Assert every case passed
         run: |
 
@@ -148,6 +148,19 @@ export const MESH_PEERS = ['productpage', 'reviews', 'details'];
  */
 export const MESH_SERVICES = [...MESH_PEERS, 'ratings', 'istio-ingressgateway'];
 
+/**
+ * The services the MESH layer header may open on: MESH_SERVICES plus OAP's
+ * `UNKNOWN`. OAP reads the Kubernetes metadata of a new pod address in the
+ * background rather than waiting for it (apache/skywalking#14135), so
+ * bookinfo's first calls count under `UNKNOWN`, and in the first minute of
+ * traffic that burst can rank above every workload.
+ *
+ * Only for the header's pick. A mesh whose calls ALL count under `UNKNOWN`
+ * must still fail, and it does on mesh.spec.ts's roster check, which requires
+ * every MESH_PEERS workload.
+ */
+export const MESH_HEADER_SERVICES = [...MESH_SERVICES, 'UNKNOWN'];
+
 /**
  * The SAME workload in the MESH_DP layer, which names services
  * `<workload>.<namespace>`. ALS produces both sets, and they are not
 
@@ -16,7 +16,7 @@
  */
 
 import { test, expect } from '../support/diagnostics.js';
-import { MESH_LAYER, MESH_SERVICES } from '../fixture.js';
+import { MESH_LAYER, MESH_HEADER_SERVICES } from '../fixture.js';
 
 // Profiling pages, which exist only where rover does.
 //
@@ -43,7 +43,7 @@ test('the eBPF profiling page mounts and resolves a service', async ({ page, pag
   // ours.
   const selected = page.locator('.service-row .svc-name');
   await expect(selected).toBeVisible({ timeout: 60_000 });
-  await expect(selected).toHaveText(new RegExp(`^(${MESH_SERVICES.join('|')})$`));
+  await expect(selected).toHaveText(new RegExp(`^(${MESH_HEADER_SERVICES.join('|')})$`));
 
   expect(pageErrors, 'an uncaught error during mount blanks the page').toEqual([]);
 });
 
@@ -19,7 +19,7 @@ import { test, expect } from '../support/diagnostics.js';
 import {
   MESH_LAYER,
   MESH_PEERS,
-  MESH_SERVICES,
+  MESH_HEADER_SERVICES,
   MESH_DP_LAYER,
   MESH_DP_SUFFIX,
 } from '../fixture.js';
@@ -41,7 +41,7 @@ test('the mesh layer lists services built from Envoy access logs', async ({ page
   // member of the known set instead.
   const selected = page.locator('.service-row .svc-name');
   await expect(selected).toBeVisible({ timeout: 45_000 });
-  await expect(selected).toHaveText(new RegExp(`^(${MESH_SERVICES.join('|')})$`));
+  await expect(selected).toHaveText(new RegExp(`^(${MESH_HEADER_SERVICES.join('|')})$`));
 
   // The roster itself is the real assertion: every one of these exists only
   // because OAP analysed Envoy access logs into mesh entities. No agent