diff --git a/.github/workflows/deploy-ios.yml b/.github/workflows/deploy-ios.yml
index 448436e..1e6e857 100644
--- a/.github/workflows/deploy-ios.yml
+++ b/.github/workflows/deploy-ios.yml
@@ -4,11 +4,11 @@ on:
   workflow_call:
     inputs:
       project-name:
-        description: 'Name of the application to build (e.g. qTox).'
+        description: "Name of the application to build (e.g. qTox)."
         required: false
         type: string
       cmake-args:
-        description: 'Arguments to pass to CMake.'
+        description: "Arguments to pass to CMake."
         required: false
         type: string
       need-qt:
@@ -29,17 +29,17 @@ jobs:
         exclude:
           - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'iphonesimulator-x86_64' }}
           - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'iphonesimulator-arm64' }}
-    runs-on: macos-14
+    runs-on: macos-26
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           submodules: true
       - name: Checkout ci-tools
         if: github.repository != 'TokTok/ci-tools'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: TokTok/ci-tools
           path: third_party/ci-tools
@@ -48,7 +48,7 @@ jobs:
         if: github.repository == 'TokTok/ci-tools'
         run: ln -s .. third_party/ci-tools
       - name: Checkout dockerfiles
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: TokTok/dockerfiles
           path: third_party/dockerfiles
@@ -81,7 +81,7 @@ jobs:
             --dep-prefix /Users/runner/work/host-qt
       - name: Cache dependencies (except Qt)
         id: cache-deps
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             /Users/runner/work/deps/bin
@@ -98,7 +98,7 @@ jobs:
           --dep-file platform/deps.depfile
           --dep-prefix /Users/runner/work/deps
       - name: Cache compiler output
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: .cache/ccache
           key: ${{ github.job }}-ios-distributable-${{ matrix.arch }}-${{ matrix.ios }}-ccache
@@ -117,7 +117,7 @@ jobs:
           ${{ inputs.cmake-args }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: ${{ steps.artifact.outputs.artifact-ref }}
           path: |
diff --git a/.github/workflows/deploy-macos.yml b/.github/workflows/deploy-macos.yml
index 039aa28..d815eba 100644
--- a/.github/workflows/deploy-macos.yml
+++ b/.github/workflows/deploy-macos.yml
@@ -4,11 +4,11 @@ on:
   workflow_call:
     inputs:
       project-name:
-        description: 'Name of the application to build (e.g. qTox).'
+        description: "Name of the application to build (e.g. qTox)."
         required: false
         type: string
       cmake-args:
-        description: 'Arguments to pass to CMake.'
+        description: "Arguments to pass to CMake."
         required: false
         type: string
       need-qt:
@@ -27,7 +27,7 @@ on:
         required: false
         type: boolean
       smoke-test:
-        description: 'Command to run to smoke test the AppImage.'
+        description: "Command to run to smoke test the AppImage."
         required: true
         type: string
       test-files:
@@ -39,13 +39,13 @@ on:
         type: string
     secrets:
       APPLE_BUILD_CERTIFICATE_BASE64:
-        description: 'Base64-encoded Apple build certificate.'
+        description: "Base64-encoded Apple build certificate."
         required: false
       APPLE_KEYCHAIN_PASSWORD:
-        description: 'Password for the Apple keychain.'
+        description: "Password for the Apple keychain."
         required: false
       APPLE_P12_PASSWORD:
-        description: 'Password for the Apple P12 certificate.'
+        description: "Password for the Apple P12 certificate."
         required: false
 
 jobs:
@@ -58,7 +58,7 @@ jobs:
         exclude:
           - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
           - macos: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && '12.0' }}
-    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'macos-26' || 'macos-15-intel' }}
     permissions:
       contents: write
     steps:
@@ -201,7 +201,7 @@ jobs:
         exclude:
           - arch: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && 'x86_64' }}
           - macos: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'packaging') && '12.0' }}
-    runs-on: ${{ matrix.arch == 'arm64' && 'macos-14' || 'macos-15-intel' }}
+    runs-on: ${{ matrix.arch == 'arm64' && 'macos-26' || 'macos-15-intel' }}
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/flutter.yml b/.github/workflows/flutter.yml
index b76b929..28e3266 100644
--- a/.github/workflows/flutter.yml
+++ b/.github/workflows/flutter.yml
@@ -248,7 +248,7 @@ jobs:
 
   macos-build:
     name: macOS build
-    runs-on: macos-14
+    runs-on: macos-26
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -285,7 +285,7 @@ jobs:
   macos-test:
     name: macOS screenshot
     needs: [macos-build]
-    runs-on: macos-14
+    runs-on: macos-26
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v7
diff --git a/.github/workflows/restyler-mirror.yml b/.github/workflows/restyler-mirror.yml
index 6275513..5c93f38 100644
--- a/.github/workflows/restyler-mirror.yml
+++ b/.github/workflows/restyler-mirror.yml
@@ -4,32 +4,16 @@ on:
   workflow_dispatch:
 
 permissions:
+  contents: read
   packages: write
 
 jobs:
   mirror:
     runs-on: ubuntu-latest
-    env:
-      SRC: public.ecr.aws/restyled-io
-      DST: ghcr.io/toktok
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
       - name: Log in to GHCR
         run: echo '${{ github.token }}' | docker login ghcr.io -u '${{ github.actor }}' --password-stdin
       - name: Mirror images
-        run: |
-          set -eu
-          for img in \
-            restyler-astyle:v3.6.2 \
-            restyler-autopep8:v2.3.2 \
-            restyler-black:v26.10.1 \
-            restyler-clang-format:v16.0.6 \
-            restyler-prettier:v3.9.10-6 \
-            restyler-reorder-python-imports:v3.19.0 \
-            restyler-shellharden:v4.3.2 \
-            restyler-shfmt:v3.14.1 \
-            restyler-stylish-haskell:v0.14.3.0 \
-            restyler-yapf:v0.43.0-1; do
-            for i in 1 2 3 4 5; do docker pull "$SRC/$img" && break; sleep 15; done
-            docker tag "$SRC/$img" "$DST/$img"
-            docker push "$DST/$img"
-          done
+        run: bin/mirror-restylers
diff --git a/bin/mirror-restylers b/bin/mirror-restylers
new file mode 100755
index 0000000..fce75f6
--- /dev/null
+++ b/bin/mirror-restylers
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# Copies the restyler images our .restyled.yaml files pin from where restyled
+# publishes them to ghcr.io/toktok, as ECR Public rate-limits the shared IPs
+# CI pulls from. Needs `docker login ghcr.io` with write access to packages.
+
+set -eu
+
+ECR=public.ecr.aws/restyled-io
+DST="${DST:-ghcr.io/toktok}"
+
+owner="${DST#*/}"
+# Settings pages of the packages pushed.
+pushed=""
+
+# Each under its own name and tag in DST. Those already there aren't pulled
+# again: ECR blocks after a few pulls.
+for src in \
+  "$ECR/restyler-astyle:v3.6.2" \
+  "$ECR/restyler-autopep8:v2.3.2" \
+  "$ECR/restyler-black:v26.10.1" \
+  "$ECR/restyler-clang-format:v16.0.6" \
+  "$ECR/restyler-clang-format:v18.1.8" \
+  "$ECR/restyler-dart-format:v3.1.13" \
+  "$ECR/restyler-prettier:v3.9.10-6" \
+  "$ECR/restyler-reorder-python-imports:v3.19.0" \
+  "$ECR/restyler-shellcheck:v0.11.0" \
+  "$ECR/restyler-shellharden:v4.3.2" \
+  "$ECR/restyler-shfmt:v3.14.1" \
+  "$ECR/restyler-stylish-haskell:v0.14.3.0" \
+  "$ECR/restyler-yapf:v0.43.0-1" \
+  docker.io/restyled/restyler-whitespace:v0.2.0.5; do
+  dst="$DST/${src##*/}"
+  if docker manifest inspect "$dst" >/dev/null 2>&1; then
+    echo "Already mirrored: $dst"
+    continue
+  fi
+  for _ in 1 2 3 4 5; do
+    docker pull "$src" && break
+    sleep 15
+  done
+  docker tag "$src" "$dst"
+  docker push "$dst"
+  name="${dst##*/}"
+  pushed="$pushed
+  https://github.com/orgs/$owner/packages/container/${name%%:*}/settings"
+done
+
+# A new package is private, which restyled can't pull.
+if [ "$pushed" != "" ]; then
+  echo
+  echo "Make these public, unless they already are (Danger Zone, Change visibility):$pushed"
+fi