GitHub Actions Self-Hosted Runner Enforcement: September 25 Upgrade Checklist
GitHub says full self-hosted runner version enforcement for GitHub Enterprise Cloud begins September 25, 2026. Two separate version rules matter: a runner must be version 2.329.0 or later to configure or re-register, and a runner that executes jobs must stay within 30 days of each new runner release. Version 2.329.0 is therefore a registration floor, not a permanent execution minimum. Runners with working auto-update can normally satisfy the rolling requirement automatically; runners with automatic updates disabled must be updated manually on a regular cadence. GitHub says any major, minor, or patch runner release counts as an available update, and jobs stop being queued when a runner is more than 30 days behind. A critical security update can pause job queuing until the runner is updated. Before September 25, upgrade active runner fleets to a currently supported release, refresh installation scripts and VM/container images, recreate runners built from stale templates, and verify representative workflows. GitHub also says the policy applies to github.com, including Enterprise Cloud and Enterprise Cloud with Data Residency, while GitHub Enterprise Server is not impacted at this time.
Self-hosted GitHub Actions jobs remain queued or stop being assigned after September 25, 2026
A new or recreated runner fails during configuration because its runner package is older than 2.329.0
An organization pinned a runner image months ago and assumed the 2.329.0 registration floor was also the permanent job-execution minimum
Actions Runner Controller or another immutable runner image uses disableUpdate or otherwise requires manual runner-version maintenance
Possible causes
GitHub is beginning full GitHub Enterprise Cloud enforcement of self-hosted runner version requirements on September 25, 2026
Registration requires runner version 2.329.0 or later, while job execution follows a separate rolling requirement to install each runner release within 30 days
Pinned VM images, container images, installation scripts and cached templates can keep recreating obsolete runner versions even after one live runner was upgraded
Runners with auto-update disabled do not satisfy the rolling requirement unless the operator maintains a manual update cadence
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Inventory the runner fleet before changing it. Record runner scope, operating system/architecture, runner version, whether automatic updates are enabled, and the VM/container/template that creates the runner. GitHub notes that registration audit-log events include the runner version but are not a complete inventory of every connected runner.
Step 2. Separate the two version gates. Use 2.329.0 only as the minimum required to configure or re-register a runner; do not treat it as the permanent minimum for executing jobs. GitHub says the effective execution minimum advances as new runner releases are published.
Step 3. Upgrade active GitHub Enterprise Cloud self-hosted runners to a currently supported runner release before September 25. For auto-updating runners, verify they can actually reach GitHub's update service rather than assuming the setting alone proves they are current.
Step 4. If automatic updates are disabled, establish a manual update process that installs each runner release within 30 days. GitHub says major, minor and patch releases all count, and a critical security update can require an immediate update before jobs will be queued again.
Step 5. Update the source of truth that creates runners: installation/bootstrap scripts, VM images, container images, Actions Runner Controller images, golden templates and deployment automation. Otherwise a scale-out, rebuild or disaster-recovery event can silently recreate an unsupported runner even after the present fleet is healthy.
Step 6. Recreate or redeploy runners built from stale cached images after the base artifact is updated. Verify the new instance reports the expected runner version before returning it to a production runner group.
Step 7. Run representative workflows against each important runner class. Confirm jobs are assigned rather than left queued, then verify checkout, dependency installation, builds, tests, artifacts, signing and deployment paths that depend on the self-hosted environment.
Step 8. Monitor runtime annotations and queue behavior during the transition. If a workflow remains queued, check runner online status, labels/group routing and supported runner version before changing workflow logic or broadening permissions.
Step 9. Keep GitHub Enterprise Server separate from the cloud deadline. GitHub says GHES is not impacted by this enforcement at this time; use the release documentation for the specific GHES version instead of copying the September 25 cloud rule onto a self-hosted server deployment.
Step 10. Document the runner version, image/template version, update mode and verification date that passed. Continue monitoring new runner releases because the 30-day execution requirement makes this an ongoing maintenance control rather than a one-time September 25 upgrade.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Upgrade and validate runners in a controlled runner group or deployment slice before replacing the entire production fleet when that is operationally practical.
Keep runner registration tokens, GITHUB_TOKEN values, cloud credentials and deployment secrets out of logs, tickets and diagnostic transcripts.
Preserve immutable-image and rollback practices while refreshing runner versions so a runner update does not silently change unrelated build dependencies.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not tell operators that upgrading to exactly 2.329.0 permanently satisfies job-execution requirements; GitHub says that version is the registration floor and the execution minimum moves forward over time.
Do not disable workflow security controls, widen repository permissions or expose secrets merely to make an outdated runner accept jobs.
Do not rely only on registration audit events as a complete runner inventory; GitHub explicitly says those events show actively registering runners but not every connected runner.
Do not claim the September 25, 2026 GitHub Enterprise Cloud enforcement applies to GitHub Enterprise Server; GitHub says GHES is not impacted at this time.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Is GitHub Actions runner version 2.329.0 enough after September 25, 2026?
It is enough for the registration-version floor, but not as a permanent execution minimum. GitHub says runners must also install each new runner release within 30 days or jobs will stop being queued to them.
What happens if my self-hosted runner is too old?
GitHub says an unsupported runner may fail to configure or re-register, and an already registered runner outside the supported execution window may stop receiving workflow jobs. Workflows targeting it can remain queued or fail.
Do self-hosted runners with automatic updates need manual upgrades?
GitHub says auto-update normally satisfies the 30-day rule as long as the runner can reach the update service. Verify that connectivity and the actual installed version instead of relying only on the setting.
Does the September 25 enforcement apply to GitHub Enterprise Server?
No. GitHub's June 12 enforcement notice says GitHub Enterprise Server is not impacted at this time. Check the release notes for the GHES version you operate separately.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI