Security and resilience

GitHub Actions self-hosted runners: minimum version deadline is March 16, 2026

GitHub extended minimum-version enforcement for self-hosted runner registration to March 16, 2026, with scheduled brownouts to expose upgrade gaps early.

2/26/20267 min readSecurity
GitHub Actions self-hosted runners: minimum version deadline is March 16, 2026

Executive summary

GitHub extended minimum-version enforcement for self-hosted runner registration to March 16, 2026, with scheduled brownouts to expose upgrade gaps early.

Last updated: 2/26/2026

Executive summary

In the February 5, 2026 changelog notice (updated on 2026-02-20), GitHub confirmed that minimum-version enforcement for self-hosted runner registration/configuration was extended to March 16, 2026.

The stated requirement is direct: runners must be on **v2.329.0 or later before running ./config.sh**.

That distinction matters because this enforcement targets the registration/config step, not merely job execution on an already-registered runner.

What exactly changes

According to the official notice:

  • brownout windows run from 2026-02-23 to 2026-03-13;
  • on 2026-03-16, registration below v2.329.0 is blocked;
  • the impact applies to GitHub.com (not GHES in this notice).

The same update also called out ARC environments: runner images used by controller-managed pools must include a compliant version.

Do not confuse two enforcement mechanisms

This is where platform communication often breaks down:

  1. Registration/config enforcement (the 2026 notice): blocks onboarding with old runner binaries.
  2. Continuous update policy (GitHub docs): if automatic updates are disabled, runners must still be updated within 30 days of a new release, or jobs may stop queueing.

So passing the registration threshold once does not remove ongoing patch responsibility.

Why this creates incidents in real organizations

Common failure points:

  • frozen runner base images with no refresh pipeline;
  • autoscaling pools still provisioning from legacy templates;
  • incomplete inventory of runner groups across orgs/projects.

When brownouts happen, teams often experience it as "platform surprise," but the root cause is usually image governance and patch-cycle debt.

7-step remediation playbook

  1. Inventory every runner provisioning path (VM, containers, ARC, manual scripts).
  2. Identify every flow still registering below v2.329.0.
  3. Update images and scripts to enforce a compliant minimum version.
  4. Recreate pools from updated templates, not only one-off hosts.
  5. Validate registration during brownout windows.
  6. Set an internal runner update SLO (for example <=14 days from release).
  7. Track actions/runner releases continuously.

Metrics worth tracking

  • percentage of runner pools on supported versions;
  • mean time from runner release to internal image rollout;
  • registration failures by version during brownouts;
  • queue latency and failure rate after updates.

Without these metrics, teams usually discover version drift only when critical CI pipelines fail.

Conclusion

The 2026-03-16 deadline is not just a technical cutoff. It is an operational maturity test for your CI platform.

Teams that treat runners as versioned platform artifacts, with refresh automation and release observability, usually handle enforcement with minimal disruption.

Closing question: can your team prove within minutes which pools still attempt registration below v2.329.0?

Sources

Related reading