diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cf577cb39..4914cb22f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -47,7 +47,7 @@ jobs:
       run:
         shell: ${{ matrix.shell || 'bash'}}
     # The type of runner that the job will run on
-    runs-on: ${{ matrix.os || 'ubuntu-22.04' }}
+    runs-on: ${{ matrix.os || 'ubuntu-24.04' }}
     # see https://github.com/containers/podman/issues/13609
     continue-on-error: ${{ contains(matrix.name, 'macos') && true || false }}
     outputs:
@@ -61,7 +61,7 @@ jobs:
         continue-on-error:
           - false
         os:
-          - ubuntu-22.04
+          - ubuntu-24.04
         task-name:
           - docs
         name:
@@ -69,7 +69,7 @@ jobs:
         include:
           - name: lint
             task-name: lint
-            os: ubuntu-22.04
+            os: ubuntu-24.04
             env:
               SKIP_PODMAN: 1
               SKIP_DOCKER: 1
@@ -108,7 +108,7 @@ jobs:
         if: contains(matrix.shell, 'wsl')
         uses: Vampire/setup-wsl@v3.1.3
         with:
-          distribution: Ubuntu-22.04
+          distribution: Ubuntu-24.04
           set-as-default: "true"
           # '-i' seems to be the only option that loads .bashrc file that we need
           # https://github.com/Vampire/setup-wsl/discussions/54
@@ -130,6 +130,7 @@ jobs:
             dbus
             dirmngr
             gawk
+            gcc
             git
             gpg
             gpg-agent
@@ -318,7 +319,7 @@ jobs:
       id-token: write
       checks: read
 
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Merge logs into a single archive
diff --git a/.readthedocs.yml b/.readthedocs.yml
index 1a7457244..c50702e60 100644
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -20,10 +20,10 @@ submodules:
   recursive: true
 
 build:
-  os: ubuntu-22.04
+  os: ubuntu-24.04
   tools:
     python: >-  # PyYAML parses it as float `3.1` it it's not an explicit string
-      3.10
+      3.12
 
 # Optionally set the version of Python and requirements required
 # to build docs
diff --git a/tools/test-setup.sh b/tools/test-setup.sh
index b662f3c91..4ead46bfb 100755
--- a/tools/test-setup.sh
+++ b/tools/test-setup.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# cSpell:ignore RPMS xorg cmdtest corepack xrandr nocolor
+# cSpell:ignore RPMS xorg cmdtest corepack xrandr nocolor userns
 #
 # This tool is used to setup the environment for running the tests. Its name
 # name and location is based on Zuul CI, which can automatically run it.
@@ -118,11 +118,31 @@ if [[ -f "/etc/redhat-release" ]]; then
     fi
 fi
 
+# Fail-fast if run on Windows or under WSL1/2 on /mnt/c because it is so slow
+# that we do not support it at all. WSL use is ok, but not on mounts.
+WSL=0
+if [[ "${OS:-}" == "windows" ]]; then
+    log error "You cannot use Windows build tools for development, try WSL."
+    exit 1
+fi
+if grep -qi microsoft /proc/version >/dev/null 2>&1; then
+    # resolve pwd symlinks and ensure than we do not run under /mnt (mount)
+    if [[ "$(pwd -P || true)" == /mnt/* ]]; then
+        log warning "Under WSL, you must avoid running from mounts (/mnt/*) due to critical performance issues."
+    fi
+    WSL=1
+fi
+
 if [[ -f "/usr/bin/apt-get" ]]; then
     INSTALL=0
     # qemu-user-static is required by podman on arm64
     # python3-dev is needed for headers as some packages might need to compile
 
+    if [[ "$WSL" == "0" ]] && [[ "$(sysctl -n kernel.apparmor_restrict_unprivileged_userns)" != "0" ]]; then
+        log warning "AppArmor restricts unprivileged user namespaces, disabling it for testing. See https://github.com/redhat-developer/vscode-extension-tester/issues/1496"
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+    fi
+
     DEBS=(curl git python3-dev python3-venv python3-pip qemu-user-static xvfb x11-xserver-utils libgbm-dev libssh-dev libonig-dev)
     # add nodejs to DEBS only if node is not already installed because
     # GHA has newer versions preinstalled and installing the rpm would
@@ -191,21 +211,6 @@ if [[ "${OS:-}" == "darwin" && "${SKIP_PODMAN:-}" != '1' ]]; then
     }
 fi
 
-# Fail-fast if run on Windows or under WSL1/2 on /mnt/c because it is so slow
-# that we do not support it at all. WSL use is ok, but not on mounts.
-WSL=0
-if [[ "${OS:-}" == "windows" ]]; then
-    log error "You cannot use Windows build tools for development, try WSL."
-    exit 1
-fi
-if grep -qi microsoft /proc/version >/dev/null 2>&1; then
-    # resolve pwd symlinks and ensure than we do not run under /mnt (mount)
-    if [[ "$(pwd -P || true)" == /mnt/* ]]; then
-        log warning "Under WSL, you must avoid running from mounts (/mnt/*) due to critical performance issues."
-    fi
-    WSL=1
-fi
-
 # User specific environment
 if ! [[ "${PATH}" == *"${HOME}/.local/bin"* ]]; then
     # shellcheck disable=SC2088