diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index eb2eef2..9bdd581 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -7,7 +7,7 @@ env:
 jobs:
   single-node:
     name: "Single node"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 40
     strategy:
       fail-fast: false
@@ -41,9 +41,8 @@ jobs:
         if: ${{ matrix.engine == 'podman' }}
         run: |
           set -eux -o pipefail
-          # Preinstalled Podman is too old (v3.4.4)
-          sudo apt-get remove podman*
-          sudo ./init-host/init-host.root.d/install-podman.sh
+          sudo apt-get update
+          sudo apt-get install -y podman-compose
           podman info
       - run: make up
       - run: sleep 5
@@ -61,13 +60,13 @@ jobs:
 
   multi-node:
     name: "Multi node (emulated using LXD)"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         include:
-          - lxc-image: ubuntu:22.04
+          - lxc-image: ubuntu:24.04
             engine: docker
 # LXD is now banned from pulling images:fedora from https://images.linuxcontainers.org/
 # TODO: switch away from LXD to Incus: https://github.com/rootless-containers/usernetes/pull/332
diff --git a/hack/create-hosts-lxd.sh b/hack/create-hosts-lxd.sh
index a85f1fc..781c04f 100755
--- a/hack/create-hosts-lxd.sh
+++ b/hack/create-hosts-lxd.sh
@@ -8,7 +8,7 @@ dir=$1
 shift
 names=$*
 
-: "${LXC_IMAGE:="ubuntu:22.04"}"
+: "${LXC_IMAGE:="ubuntu:24.04"}"
 LXC="sudo lxc"
 
 echo "USER=${USER}"
@@ -47,6 +47,9 @@ for name in ${names}; do
 	${LXC} config device add "${name}" bind-boot disk source=/boot path=/boot readonly=true
 	${LXC} config set "${name}" user.user-data - <"${userdata}"
 	${LXC} start "${name}"
+	# `slirp4netns --enable-sandbox` inside LXD (Ubuntu 24.04) requires amending the AppArmor rule.
+	# https://github.com/rootless-containers/slirp4netns/issues/348#issuecomment-2288124206
+	${LXC} shell "${name}" -- bash -c 'echo "pivot_root," >>/etc/apparmor.d/local/slirp4netns'
 	sleep 10
 	ip="$(${LXC} exec "${name}" -- ip --json route get 1 | jq -r .[0].prefsrc)"
 	echo "Host ${name}" >>"${ssh_config}"