diff --git a/.github/workflows/build-base-images.yml b/.github/workflows/build-base-images.yml
index d370a0d1a..73156f6e8 100644
--- a/.github/workflows/build-base-images.yml
+++ b/.github/workflows/build-base-images.yml
@@ -17,6 +17,7 @@ jobs:
           - ubuntu-20
           - ubuntu-22
           - ubuntu-24
+          - ubuntu-26
           - debian-11
           - debian-12
           - debian-13
diff --git a/build-in-container-inner.sh b/build-in-container-inner.sh
index 2ae3086d8..af39b0618 100755
--- a/build-in-container-inner.sh
+++ b/build-in-container-inner.sh
@@ -67,12 +67,12 @@ install_mission_portal_deps() (
 
     if [ -f "$BASEDIR/mission-portal/composer.json" ]; then
         echo "Installing Mission Portal PHP dependencies..."
-        (cd "$BASEDIR/mission-portal" && php /usr/bin/composer.phar install --no-dev --ignore-platform-reqs --prefer-dist)
+        (cd "$BASEDIR/mission-portal" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
     fi
 
     if [ -f "$BASEDIR/nova/api/http/composer.json" ]; then
         echo "Installing Nova API PHP dependencies..."
-        (cd "$BASEDIR/nova/api/http" && php /usr/bin/composer.phar install --no-dev --ignore-platform-reqs --prefer-dist)
+        (cd "$BASEDIR/nova/api/http" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
     fi
 
     if [ -f "$BASEDIR/mission-portal/public/themes/default/bootstrap/cfengine_theme.less" ]; then
@@ -84,7 +84,7 @@ install_mission_portal_deps() (
 
     if [ -f "$BASEDIR/mission-portal/ldap/composer.json" ]; then
         echo "Installing LDAP API PHP dependencies..."
-        (cd "$BASEDIR/mission-portal/ldap" && php /usr/bin/composer.phar install --no-dev --ignore-platform-reqs --prefer-dist)
+        (cd "$BASEDIR/mission-portal/ldap" && composer install --no-dev --ignore-platform-reqs --prefer-dist)
     fi
 
     # Composer falls back to git clone when GitHub's anonymous zipball
diff --git a/ci/linux-install-composer.sh b/ci/linux-install-composer.sh
old mode 100644
new mode 100755
diff --git a/container/Dockerfile.debian b/container/Dockerfile.debian
index c16816023..bc139e0f9 100644
--- a/container/Dockerfile.debian
+++ b/container/Dockerfile.debian
@@ -24,7 +24,9 @@ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
     && apt-get install -y nodejs php-cli php-zip \
     && rm -rf /var/lib/apt/lists/*
 RUN npm install -g less
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer.phar
+# Checksum-verified, version-pinned Composer (shared with the build hosts).
+COPY --from=ci linux-install-composer.sh /tmp/
+RUN /tmp/linux-install-composer.sh
 
 # Remove system dev libraries that conflict with bundled deps
 # (from cfengine-build-host-setup.cf lines 53-59)
diff --git a/container/Dockerfile.rhel b/container/Dockerfile.rhel
index 3a2bd265a..12d5a2179 100644
--- a/container/Dockerfile.rhel
+++ b/container/Dockerfile.rhel
@@ -43,7 +43,9 @@ RUN if [ -n "${PHP_MODULE_STREAM}" ]; then \
     && (dnf install -y php-json || true) \
     && (dnf install -y php-zip || dnf install -y php-pecl-zip || true) \
     && dnf clean all
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer.phar
+# Checksum-verified, version-pinned Composer (shared with the build hosts).
+COPY --from=ci linux-install-composer.sh /tmp/
+RUN /tmp/linux-install-composer.sh
 
 # Rust + protobuf for the cargo-based leech2 dep (prebuilt tarballs, shared with Debian).
 COPY --from=ci linux-install-protobuf.sh linux-install-rust.sh /tmp/
diff --git a/platforms.json b/platforms.json
index 4e1a44e4c..b350354ff 100644
--- a/platforms.json
+++ b/platforms.json
@@ -24,6 +24,13 @@
     "base_image_sha": "sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90",
     "dockerfile": "Dockerfile.debian"
   },
+  "ubuntu-26": {
+    "image_name": "cfengine-builder-ubuntu-26",
+    "image_version": "latest",
+    "base_image": "ubuntu:26.04",
+    "base_image_sha": "sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb",
+    "dockerfile": "Dockerfile.debian"
+  },
   "debian-11": {
     "image_name": "cfengine-builder-debian-11",
     "image_version": "20260721T102234Z",