diff --git a/.github/workflows/cache_retain.yml b/.github/workflows/cache_retain.yml
index 853d42ba8ba2..fb03554a32be 100644
--- a/.github/workflows/cache_retain.yml
+++ b/.github/workflows/cache_retain.yml
@@ -35,7 +35,7 @@ permissions:
 jobs:
   retain-maven-cache:
     name: Run all tests with Maven
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 37ac83bf5b57..1e34fc4f9890 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -26,7 +26,7 @@ on:
 permissions: {}
 jobs:
   Fuzzing:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       security-events: write
     strategy:
diff --git a/.github/workflows/icu4c.yml b/.github/workflows/icu4c.yml
index a4c8ff409ea6..9909375027fb 100644
--- a/.github/workflows/icu4c.yml
+++ b/.github/workflows/icu4c.yml
@@ -42,7 +42,7 @@ jobs:
 
   # ICU4C docs build using doxygen..
   icu4c-docs-build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -65,7 +65,7 @@ jobs:
   #
   # Invokes test/hdrtst to check public headers compliance.
   gcc-debug-build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -85,7 +85,7 @@ jobs:
 
   #gcc 11 with c++ 20
   gcc11-cpp20:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Install GCC-11
@@ -110,7 +110,7 @@ jobs:
   # (FORCE guards make this tool pass but won't compile to working code.
   # See the testtagsguards.sh script for details.)
   clang-release-build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -158,7 +158,7 @@ jobs:
         build_option:
          [ --enable-static, --enable-static --disable-shared ]
          # --disable-shared has a build problem.
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -174,7 +174,7 @@ jobs:
 
   # Out of source build with gcc 10, c++14, and extra warnings; executes icuinfo.
   gcc-10-stdlib17:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -195,7 +195,7 @@ jobs:
 
   # Clang Linux with address sanitizer.
   clang-asan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -209,7 +209,7 @@ jobs:
           LDFLAGS: -fsanitize=address
   # Clang Linux with leak sanitizer.
   clang-lsan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -224,7 +224,7 @@ jobs:
           ASAN_OPTIONS: detect_leaks=1
   # Clang Linux with undefined-behavior sanitizer.
   clang-ubsan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -239,7 +239,7 @@ jobs:
           LDFLAGS: -fsanitize=undefined -fsanitize=alignment -fno-sanitize-recover=undefined,alignment
   # Control Flow Integrity.
   clang-cfi:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -258,7 +258,7 @@ jobs:
 
   # Clang Linux with thread sanitizer.
   clang-tsan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -280,7 +280,7 @@ jobs:
   # this check became flaky. The build apparently was not done copying one or another .ucm file before
   # calling makeconv for it, although the Makefile has appropriate dependencies.
   clang-datafilter:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Extract ICU version
@@ -302,7 +302,7 @@ jobs:
 
   # Clang Linux with CPP 17
   clang-cpp17:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Build ICU4C with CPP 17
@@ -313,7 +313,7 @@ jobs:
 
   # Clang Linux with LANG: en_US@calendar=gregorian;hours=h12
   clang-lang-with-extn-tags:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Linux Clang - LANG has extension tags
@@ -324,7 +324,7 @@ jobs:
 
   # Clang Linux 18 with CPP20 and treat warnings as errors
   clang18-cpp20-warning-as-errors:
-      runs-on: ubuntu-latest
+      runs-on: ubuntu-22.04  # Updated in BRS
       strategy:
         fail-fast: false
         matrix:
@@ -349,7 +349,7 @@ jobs:
 
   # MacOS with clang
   macos-clang:
-    runs-on: macos-latest
+    runs-on: macos-14  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: ICU4C with clang on MacOS
@@ -362,7 +362,7 @@ jobs:
 
   # Windows MSVC builds
   windows-msvc:
-    runs-on: windows-2022
+    runs-on: windows-2022  # Updated in BRS
     strategy:
       fail-fast: false
       matrix:
@@ -394,7 +394,7 @@ jobs:
 
   # Windows data filter build
   windows-msvc-datafilter:
-    runs-on: windows-latest
+    runs-on: windows-2022  # Updated in BRS
     timeout-minutes: 30
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -410,7 +410,7 @@ jobs:
 
   # Windows MSVC distribution release
   windows-msvc-dist-release:
-    runs-on: windows-latest
+    runs-on: windows-2022  # Updated in BRS
     permissions:
       contents: write # So that we can upload to release
     timeout-minutes: 30
@@ -482,7 +482,7 @@ jobs:
 
   # Window MSYS2 tests
   windows-msys2-gcc-x86_64:
-    runs-on: windows-latest
+    runs-on: windows-2022  # Updated in BRS
     timeout-minutes: 45
     defaults:
       run:
@@ -519,7 +519,7 @@ jobs:
 
   # Run ICU4C tests with stubdata.
   run-with-stubdata:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -562,7 +562,7 @@ jobs:
 
   # Test U_CHARSET_IS_UTF8
   u-charset-is-utf8-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
@@ -572,7 +572,7 @@ jobs:
 
   # Test U_OVERRIDE_CXX_ALLOCATION-is-0-test
   u-override-cxx-allocation-is-0-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
@@ -583,7 +583,7 @@ jobs:
 
   # Test LSTM
   lstm-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
@@ -594,7 +594,7 @@ jobs:
 
   # Test adaboost
   adaboost-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
@@ -605,7 +605,7 @@ jobs:
 
   # Build and run testmap
   testmap:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: |
@@ -618,28 +618,28 @@ jobs:
 
   # Copyright scan
   copyright-scan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: perl tools/scripts/cpysearch/cpyscan.pl
 
   # Check compilation of internal headers.
   internal-header-compilation:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: cd icu4c/source; test/hdrtst/testinternalheaders.sh
 
   # Check source files for valid UTF-8 and for absence of BOM.
   valid-UTF-8-and-no-BOM-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - run: tools/scripts/icu-file-utf8-check.py
 
   # Run unit tests with UCONFIG_NO_XXX variations.
   uconfig-unit-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     strategy:
       # "fail-fast: false" lets other jobs keep running even if the test breaks in some other uconfig.
       fail-fast: false
@@ -686,7 +686,7 @@ jobs:
 
   # Run header tests with UCONFIG_NO_XXX variations.
   uconfig-header-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     strategy:
       # "fail-fast: false" lets other jobs keep running even if the test breaks in some other uconfig.
       fail-fast: false
@@ -737,7 +737,7 @@ jobs:
 
   # Build Unicode update tools
   unicode-update-tools:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3.0.0
@@ -776,7 +776,7 @@ jobs:
 
 # Build and run ICU4C samples
   icu4c-test-samples:
-      runs-on: ubuntu-latest
+      runs-on: ubuntu-22.04  # Updated in BRS
       steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -801,7 +801,7 @@ jobs:
 
   # https://unicode-org.github.io/icu/processes/release/tasks/integration.html#verify-that-icu4c-tests-pass-without-collation-rule-strings
   icu4c-without-collation-rule-strings:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Install hjson dependency
@@ -841,7 +841,7 @@ jobs:
 
   # https://unicode-org.github.io/icu/processes/release/tasks/healthy-code.html#test-uconfig_no_conversion
   icu4c-uconfig-no-conversion:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Set UCONFIG_NO_CONVERSION and configure ICU4C
@@ -861,7 +861,7 @@ jobs:
 
   # Workflow for ICU Export Data for ICU4X
   icu4c-icuexportdata:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       contents: write # So that we can upload to release
     timeout-minutes: 30
diff --git a/.github/workflows/icu4j.yml b/.github/workflows/icu4j.yml
index 538725ba7172..8086dc8bff66 100644
--- a/.github/workflows/icu4j.yml
+++ b/.github/workflows/icu4j.yml
@@ -44,7 +44,7 @@ jobs:
   # This job is created according to the cache strategy of reuse from a single job:
   # https://github.com/actions/cache/blob/main/caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job
   icu4j-mvn-init-cache:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@v4
@@ -76,7 +76,7 @@ jobs:
       fail-fast: false
       matrix:
         java-version: [ '8', '11', '17', '21' ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@v4
@@ -109,7 +109,7 @@ jobs:
   lstm-icu4j-build-and-test:
     if: false  # TODO(ICU-22505)
     needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@v4
@@ -150,7 +150,7 @@ jobs:
   adaboost-icu4j-build-and-test:
     if: false # Temporary disable, until we disable the .jar creation from C and distribute the individual files
     needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@v4
diff --git a/.github/workflows/icu_common.yml b/.github/workflows/icu_common.yml
index 2b9c1d86c5c6..e8b548fbe7ed 100644
--- a/.github/workflows/icu_common.yml
+++ b/.github/workflows/icu_common.yml
@@ -33,14 +33,14 @@ jobs:
 
   # Copyright scan
   copyright-scan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@v4
       - run: perl tools/scripts/cpysearch/cpyscan.pl
 
   # Check source files for valid UTF-8 and for absence of BOM.
   valid-UTF-8-and-no-BOM-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@v4
       - run: tools/scripts/icu-file-utf8-check.py
@@ -50,7 +50,7 @@ jobs:
   # This job is created according to the cache strategy of reuse from a single job:
   # https://github.com/actions/cache/blob/main/caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job
   icu4j-mvn-init-cache:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@v4
@@ -77,7 +77,7 @@ jobs:
   # Verify icu4c release tools buildability.
   icu4c-release-tools:
     needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@v4
       - name: Restore read-only cache of local Maven repository
diff --git a/.github/workflows/icu_docs.yml b/.github/workflows/icu_docs.yml
index 239ee4afb8d6..51b2e4765f7b 100644
--- a/.github/workflows/icu_docs.yml
+++ b/.github/workflows/icu_docs.yml
@@ -37,7 +37,7 @@ jobs:
   # Keep in sync with deploy workflow in `jekyll-gh-pages.yml`
   test-docs-build:
     name: Test build of User Guide docs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/icu_envtest.yml b/.github/workflows/icu_envtest.yml
index b88aac33bb08..d52d359d40cb 100644
--- a/.github/workflows/icu_envtest.yml
+++ b/.github/workflows/icu_envtest.yml
@@ -25,7 +25,7 @@ jobs:
   #=================================================================
   # locale env tests.
   env-test-locale:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     strategy:
       # "fail-fast: false" let other jobs keep running even if the test break in some locales.
       fail-fast: false
@@ -82,7 +82,7 @@ jobs:
   #=================================================================
   # tz env tests.
   env-test-tz:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     strategy:
       # "fail-fast: false" let other jobs keep running even if the test break in some timezones.
       fail-fast: false
diff --git a/.github/workflows/icu_exhaustive_tests.yml b/.github/workflows/icu_exhaustive_tests.yml
index 88f25ed9c8d3..e83e79d092c0 100644
--- a/.github/workflows/icu_exhaustive_tests.yml
+++ b/.github/workflows/icu_exhaustive_tests.yml
@@ -38,7 +38,7 @@ concurrency:
 jobs:
   # Runs exhaustive tests for ICU4J on Linux
   icu4j-linux:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     timeout-minutes: 180
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -55,7 +55,7 @@ jobs:
 
 
   icu4c-linux-clang:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
diff --git a/.github/workflows/icu_merge_ci.yml b/.github/workflows/icu_merge_ci.yml
index 76a94b994794..9abc7638978e 100644
--- a/.github/workflows/icu_merge_ci.yml
+++ b/.github/workflows/icu_merge_ci.yml
@@ -36,7 +36,7 @@ jobs:
   # This job is created according to the cache strategy of reuse from a single job:
   # https://github.com/actions/cache/blob/main/caching-strategies.md#make-cache-read-only--reuse-cache-from-centralized-job
   icu4j-mvn-init-cache:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -62,7 +62,7 @@ jobs:
   # Test ICU4J with little-endian ICU4C data only
   icu4j-little-endian-data-test:
     needs: icu4j-mvn-init-cache
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -97,7 +97,7 @@ jobs:
   icu4c-store-perf-libs:
     # Run performance tests only on the main branch of the ICU repository.
     if: github.repository == 'unicode-org/icu' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -138,7 +138,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
@@ -212,7 +212,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
@@ -277,7 +277,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Create directory for lib files
@@ -326,7 +326,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -388,7 +388,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -452,7 +452,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -521,7 +521,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -660,7 +660,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -743,7 +743,7 @@ jobs:
       contents: write
       deployments: write
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout and setup
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -807,7 +807,7 @@ jobs:
     if: github.repository == 'unicode-org/icu' && github.ref == 'refs/heads/main'
     name: Copy perf data to remote repo for visualization
     needs: [icu4c-performance-tests, icu4c-performance-tests-with-files, icu4c-strsrchperf, icu4j-unicodesetperf, icu4j-ucharacterperf, icu4j-decimalformatperf, icu4j-normperf, icu4j-converterperf, icu4j-dateformatperf]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -827,7 +827,7 @@ jobs:
 
   # Build ICU and tests sample on some windows configurations
   icu4c-windows-msvc-postmerge:
-    runs-on: windows-2022
+    runs-on: windows-2022  # Updated in BRS
     timeout-minutes: 30
     strategy:
       matrix:
@@ -852,7 +852,7 @@ jobs:
         run: icu4c/source/samples/all/samplecheck.bat ${{ matrix.arch }} ${{ matrix.config }}
 
   icu4c-windows-cygwin-gcc:
-    runs-on: windows-latest
+    runs-on: windows-2022  # Updated in BRS
     timeout-minutes: 50
     env:
       ICU_CI_CACHE: c:\icu-ci-cache
diff --git a/.github/workflows/icu_valgrind.yml b/.github/workflows/icu_valgrind.yml
index 1f406e8fe23f..c0a70e263106 100644
--- a/.github/workflows/icu_valgrind.yml
+++ b/.github/workflows/icu_valgrind.yml
@@ -34,7 +34,7 @@ permissions:
 
 jobs:
   clang-valgrind-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Install valgrind
         run: |
@@ -72,7 +72,7 @@ jobs:
               --show-reachable=yes ./icuinfo;
 
   clang-valgrind-intltest:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     strategy:
       # "fail-fast: false" lets other jobs keep running even if the test breaks in some other test.
       fail-fast: false
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index d1cb05b79782..691950f0fbef 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -34,7 +34,7 @@ jobs:
   # Build job
   # Keep in sync with docs test workflow in `icu_docs.yml`
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -71,7 +71,7 @@ jobs:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     needs: build
     steps:
       - name: Deploy to GitHub Pages
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
index 131e9881fecd..8f1b1c116aa5 100644
--- a/.github/workflows/maven.yaml
+++ b/.github/workflows/maven.yaml
@@ -14,7 +14,7 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       packages: write
     outputs:
diff --git a/.github/workflows/release-check-sign.yml b/.github/workflows/release-check-sign.yml
index 96464ace309e..6ed0da2eddd5 100644
--- a/.github/workflows/release-check-sign.yml
+++ b/.github/workflows/release-check-sign.yml
@@ -13,7 +13,7 @@ env:
 jobs:
   sign_and_checksums:
     if: ${{ inputs.gitReleaseTag && startsWith(inputs.gitReleaseTag, 'release-') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     environment: release-env
 
     permissions:
diff --git a/.github/workflows/release-icu4c-fedora.yml b/.github/workflows/release-icu4c-fedora.yml
index b8757fa1fb1c..b64729377ba1 100644
--- a/.github/workflows/release-icu4c-fedora.yml
+++ b/.github/workflows/release-icu4c-fedora.yml
@@ -16,7 +16,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     environment: release-env
 
     container:
diff --git a/.github/workflows/release-icu4c-ubuntu.yml b/.github/workflows/release-icu4c-ubuntu.yml
index c53ee7cbe289..c0418d47827c 100644
--- a/.github/workflows/release-icu4c-ubuntu.yml
+++ b/.github/workflows/release-icu4c-ubuntu.yml
@@ -16,7 +16,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     environment: release-env
 
     permissions:
diff --git a/.github/workflows/release-icu4j-maven.yml b/.github/workflows/release-icu4j-maven.yml
index c7f918be0cc4..33c6fa40e1dd 100644
--- a/.github/workflows/release-icu4j-maven.yml
+++ b/.github/workflows/release-icu4j-maven.yml
@@ -39,7 +39,7 @@ env:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     environment: release-env
 
     permissions:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 380efec2f686..16f648c9ad89 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write
diff --git a/.github/workflows/wait-for-checks.yml b/.github/workflows/wait-for-checks.yml
index 56eac3b305fa..667defbbf6b7 100644
--- a/.github/workflows/wait-for-checks.yml
+++ b/.github/workflows/wait-for-checks.yml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   enforce-all-checks:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       checks: read
     steps:
diff --git a/docs/processes/release/tasks/build.md b/docs/processes/release/tasks/build.md
index d307bfe51ac2..066ce3d8a2b4 100644
--- a/docs/processes/release/tasks/build.md
+++ b/docs/processes/release/tasks/build.md
@@ -59,6 +59,10 @@ Also, please look out for this type of message: "\***\*\* WARNING Bad namespace
 not defined inside the "icu" namespace. Consider adding **U_NAMESPACE_BEGIN**
 and **U_NAMESPACE_END** around the class and member definitions.
 
+## Update the runners
+
+In all workflow yaml files, update macos-n, ubuntu-p.q, windows-yyyy to the version currently designated -latest on https://github.com/actions/runner-images?tab=readme-ov-file#available-images.
+
 ## Update the pool bundles
 
 *Obsolete for ICU 64+*: The pool bundles are no longer checked in. Instead,
diff --git a/vendor/double-conversion/upstream/.github/workflows/ci.yml b/vendor/double-conversion/upstream/.github/workflows/ci.yml
index bbc25b74f45a..4fa0c4e59c14 100644
--- a/vendor/double-conversion/upstream/.github/workflows/ci.yml
+++ b/vendor/double-conversion/upstream/.github/workflows/ci.yml
@@ -9,7 +9,10 @@ jobs:
   build:
     strategy:
       matrix:
-        container: [ ubuntu-latest, macos-latest, windows-latest ]
+        container:  # Updated in BRS
+        - ubuntu-22.04
+        - macos-14
+        - windows-2022
         build_type: [ Debug, Release ]
 
 
diff --git a/vendor/double-conversion/upstream/.github/workflows/cifuzz.yml b/vendor/double-conversion/upstream/.github/workflows/cifuzz.yml
index f29b4dc78b7a..fdf828ad1daa 100644
--- a/vendor/double-conversion/upstream/.github/workflows/cifuzz.yml
+++ b/vendor/double-conversion/upstream/.github/workflows/cifuzz.yml
@@ -4,7 +4,7 @@ permissions:
   contents: read
 jobs:
  Fuzzing:
-   runs-on: ubuntu-latest
+   runs-on: ubuntu-22.04  # Updated in BRS
    permissions:
      security-events: write
    steps:
diff --git a/vendor/double-conversion/upstream/.github/workflows/scons.yml b/vendor/double-conversion/upstream/.github/workflows/scons.yml
index 0505ced7fefc..f3e72a33a4f7 100644
--- a/vendor/double-conversion/upstream/.github/workflows/scons.yml
+++ b/vendor/double-conversion/upstream/.github/workflows/scons.yml
@@ -7,7 +7,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
 
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
diff --git a/vendor/double-conversion/upstream/.github/workflows/scorecard.yml b/vendor/double-conversion/upstream/.github/workflows/scorecard.yml
index b8d556fe1902..fe575f44865f 100644
--- a/vendor/double-conversion/upstream/.github/workflows/scorecard.yml
+++ b/vendor/double-conversion/upstream/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04  # Updated in BRS
     permissions:
       security-events: write # to upload the results to code-scanning dashboard
       id-token: write # to publish results and get a badge