diff --git a/.github/workflows/install-test-comment.yml b/.github/workflows/install-test-comment.yml
index 3820c3c..b4c9c7b 100644
--- a/.github/workflows/install-test-comment.yml
+++ b/.github/workflows/install-test-comment.yml
@@ -18,7 +18,7 @@ permissions:
 jobs:
   comment:
     if: github.event.workflow_run.event == 'pull_request'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     env:
       GH_TOKEN: ${{ github.token }}
       REPO: ${{ github.repository }}
diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml
index ebd55ed..1e8470e 100644
--- a/.github/workflows/install-test.yml
+++ b/.github/workflows/install-test.yml
@@ -25,7 +25,7 @@ jobs:
     # GitHub's runner: it is somebody else's code, and it has no business on
     # our account's machines. No cache volume either way: what one pull
     # request leaves in a cache the next run would trust.
-    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'namespace-profile-linux-amd64-16x32' }}
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-26.04' || 'namespace-profile-linux-amd64-16x32' }}
     timeout-minutes: 75
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,7 +43,7 @@ jobs:
         run: NO_BOOT_OFFER=1 ./bin/omarchy-iso-make
 
       # The harness runs in an Arch container: Arch's current QEMU and OVMF
-      # (QEMU 11) instead of Ubuntu 24.04's QEMU 8.2, at the paths the
+      # (QEMU 11) instead of the runner's older one, at the paths the
       # harness expects, the same as on an Omarchy workstation.
       - name: Install unattended, then boot the installed system
         run: |
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 30209f8..d109201 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -50,7 +50,7 @@ jobs:
   # test/vm-image/nightly-plan decides, from what is fetched here.
   plan:
     name: Plan
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 5
     outputs:
       channels: ${{ steps.plan.outputs.channels }}
@@ -229,7 +229,7 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJSON(needs.plan.outputs.channels) }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 45
     environment: nightly
     # actions: read is for finding and fetching the build job's artifact.
@@ -258,8 +258,12 @@ jobs:
       - name: Fetch the release from the build job
         env:
           GH_TOKEN: ${{ github.token }}
+          # Not /tmp: on Ubuntu 26.04 it is held in memory, and the zip is
+          # gigabytes.
+          TMPDIR: ${{ runner.temp }}
         run: |
-          sudo apt-get update -qq && sudo apt-get install -y -qq aria2 unzip >/dev/null
+          df -h "$TMPDIR" .
+          command -v aria2c unzip >/dev/null || { sudo apt-get update -qq && sudo apt-get install -y -qq aria2 unzip >/dev/null; }
           ./test/vm-image/nightly-fetch "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID" "nightly-$CHANNEL-$GITHUB_RUN_ID" out
 
       # A current rclone, by version and checksum. Ubuntu's is 1.60 from 2022:
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 823b6bd..137346f 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   unit:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/test/unit/nightly-test.sh b/test/unit/nightly-test.sh
index cf7624d..f17bd5d 100644
--- a/test/unit/nightly-test.sh
+++ b/test/unit/nightly-test.sh
@@ -181,6 +181,8 @@ STUB
   refused "an artifact that does not exist" env FETCH_IDS=" " PATH="$stubs:$PATH" TMPDIR="$tmp" FETCH_LOG="$tmp/fetch.log" "$fetch" omacom/omarchy-iso 7 nightly-edge-7 "$tmp/f3"
   refused "a download of the wrong size" env FETCH_SIZE=1 PATH="$stubs:$PATH" TMPDIR="$tmp" FETCH_LOG="$tmp/fetch.log" "$fetch" omacom/omarchy-iso 7 nightly-edge-7 "$tmp/f4"
   [[ ! -e $tmp/f4/edge ]] || fail "fetch: a download of the wrong size was unpacked"
+  refused "an artifact larger than the free space" env FETCH_SIZE=9000000000000000 PATH="$stubs:$PATH" TMPDIR="$tmp" FETCH_LOG="$tmp/fetch.log" "$fetch" omacom/omarchy-iso 7 nightly-edge-7 "$tmp/f5"
+  grep -q "MiB free" "$tmp/refused.err" || fail "fetch: too little room is not what was reported"
 else
   echo "nightly-fetch tests skipped: no zip or unzip here"
 fi
diff --git a/test/vm-image/nightly-fetch b/test/vm-image/nightly-fetch
index 723c4a5..0ce1f04 100755
--- a/test/vm-image/nightly-fetch
+++ b/test/vm-image/nightly-fetch
@@ -8,11 +8,14 @@
 # release would outlast the job. An artifact is one zip at a signed address,
 # so this asks the API for that address and takes it over 16 connections.
 #
+# The zip goes to TMPDIR and is deleted once unpacked, so there has to be room
+# for the artifact twice: point TMPDIR at a disk, not at a /tmp held in memory.
+#
 # Needs gh (with GH_TOKEN allowed to read the run's artifacts), curl, aria2c
 # and unzip. A run started again keeps the artifacts of its earlier attempts
 # under the same name: the newest is the one fetched.
 set -euo pipefail
-[[ $# -eq 4 ]] || { sed -n '2,13p' "$0" >&2; exit 2; }
+[[ $# -eq 4 ]] || { sed -n '2,16p' "$0" >&2; exit 2; }
 repo=$1 run=$2 name=$3 out=$4
 fail() { echo "nightly-fetch: $*" >&2; exit 1; }
 
@@ -23,6 +26,11 @@ size=$(gh api "repos/$repo/actions/artifacts/$id" --jq .size_in_bytes)
 echo "nightly-fetch: artifact $id, $((size / 1048576)) MiB"
 
 zip=$(mktemp -u "${TMPDIR:-/tmp}/nightly-fetch.XXXXXX.zip")
+mkdir -p "$out"
+for place in "$(dirname "$zip")" "$out"; do
+  free=$(( $(df --output=avail -B1 "$place" | tail -n 1) ))
+  (( free > size )) || fail "$place has $((free / 1048576)) MiB free, the artifact is $((size / 1048576)) MiB"
+done
 trap 'rm -f "$zip" "$zip.aria2"' EXIT
 started=$(date +%s)
 # The address is signed for a few minutes. A try that fails asks for a new one
@@ -44,6 +52,5 @@ done
 seconds=$(( $(date +%s) - started ))
 echo "nightly-fetch: downloaded in $seconds s, $(( size / 1048576 / (seconds > 0 ? seconds : 1) )) MiB/s"
 
-mkdir -p "$out"
 unzip -q "$zip" -d "$out"
 echo "nightly-fetch: $(find "$out" -type f | wc -l) files in $out"