diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml
index b86d2c95..0fa9fcea 100644
--- a/.github/workflows/media.yml
+++ b/.github/workflows/media.yml
@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 180
     env:
       ASSET_BASE_URL: ${{ vars.ASSET_BASE_URL || 'https://art.rgbknights.com' }}
@@ -51,7 +51,7 @@ jobs:
           test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
           test -f media/manifest.py
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.13'
 
@@ -66,7 +66,7 @@ jobs:
 
       - name: Restore recent successful R2 and public URL checks
         if: github.event_name != 'pull_request'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: _media/verification-cache.json
           key: public-story-art-${{ github.run_id }}