diff --git a/CHANGELOG.md b/CHANGELOG.md
index b07945c..ec2f4e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ The notable changes of every release. The section of a version is the text of it
 
 ## [Unreleased]
 
+### Fixed
+
+- The conformance tests start again on GitHub's current Ubuntu runners: their MongoDB is 9.0.4 now,
+  pinned by digest. MongoDB 8.0 and newer exit at startup on a Linux kernel from 6.19 up to 7.0.13,
+  and before 9.0.4 they took Ubuntu's 7.0 kernels for 7.0.0 (SERVER-121912, SERVER-131779), so the
+  suite found no database and the nightly run failed since the runner image of 2026-10-18.
+
 ## [0.6.0] - 2026-10-12
 
 A receiver has to know the audience of its SETs. A Spring Boot receiver that configured
diff --git a/easyssf-receiver-spring-boot-conformance-tests/README.md b/easyssf-receiver-spring-boot-conformance-tests/README.md
index 0fcb303..e668fe3 100644
--- a/easyssf-receiver-spring-boot-conformance-tests/README.md
+++ b/easyssf-receiver-spring-boot-conformance-tests/README.md
@@ -55,7 +55,7 @@ reaches the receiver on the Docker host as `host.testcontainers.internal`.
 |---|---|---|
 | `cts.suite.image` / `CTS_SUITE_IMAGE` | `registry.gitlab.com/openid/conformance-suite@sha256:…` (`release-v5.3.2`, pinned by digest, see below) | the suite image |
 | `cts.suite.nginx-image` | `registry.gitlab.com/openid/conformance-suite/nginx@sha256:…` (`release-v5.3.2`, pinned by digest) | its nginx image |
-| `cts.suite.mongodb-image` | `mongo@sha256:…` (`9.0.2-noble`, pinned by digest; the suite itself runs 6.0.13 in production) | its MongoDB image |
+| `cts.suite.mongodb-image` | `mongo@sha256:…` (`9.0.4`, pinned by digest; the suite itself runs 6.0.13 in production, older 8.x and 9.x releases do not start on current Ubuntu kernels) | its MongoDB image |
 | `cts.suite.port` | `18443` | host port of the Testcontainers-started suite |
 | `cts.receiver.port` | `9444` | port of the receiver under test |
 | `cts.receiver.push-url` | `https://<host as seen from the suite>:<receiver port>/ssf/push` | the push URL the receiver registers |
diff --git a/easyssf-test-conformance/src/main/java/org/easyssf/test/conformance/ConformanceSettings.java b/easyssf-test-conformance/src/main/java/org/easyssf/test/conformance/ConformanceSettings.java
index 7cd1815..3ea477b 100644
--- a/easyssf-test-conformance/src/main/java/org/easyssf/test/conformance/ConformanceSettings.java
+++ b/easyssf-test-conformance/src/main/java/org/easyssf/test/conformance/ConformanceSettings.java
@@ -49,9 +49,13 @@ public final class ConformanceSettings {
     /**
      * The suite's own compose file runs MongoDB 6.0.13, as the suite does in production.
      * For the tests here a current release, with far fewer known vulnerabilities, works
-     * just as well: mongo:9.0.2-noble, pinned by digest like the suite images.
+     * just as well: mongo:9.0.4, pinned by digest like the suite images. Not older:
+     * MongoDB 8.0 and newer refuse to start on a Linux kernel from 6.19 up to 7.0.13 (a
+     * tcmalloc incompatibility, SERVER-121912), and before 9.0.4 they took Ubuntu's 7.0
+     * kernels, the ones of GitHub's runners since October 2026, for 7.0.0
+     * (SERVER-131779).
      */
-    static final String DEFAULT_SUITE_MONGODB_IMAGE = "mongo@sha256:61dd87ff554dc20386c63ebe1f7ede27314370ad5a7bf357c685fab424672158";
+    static final String DEFAULT_SUITE_MONGODB_IMAGE = "mongo@sha256:dc28ed5a9d0fc616903c3f463bb1e53b92b49f441721b91926e87d90bf957ce8";
 
     static final int DEFAULT_SUITE_PORT = 18443;