diff --git a/build-scripts/labels.txt b/build-scripts/labels.txt
index b6f880e9f..4cc6e8b79 100644
--- a/build-scripts/labels.txt
+++ b/build-scripts/labels.txt
@@ -18,6 +18,8 @@ PACKAGES_HUB_x86_64_linux_ubuntu_22
 PACKAGES_HUB_arm_64_linux_ubuntu_22
 PACKAGES_HUB_x86_64_linux_ubuntu_24
 PACKAGES_HUB_arm_64_linux_ubuntu_24
+PACKAGES_HUB_x86_64_linux_ubuntu_26
+PACKAGES_HUB_arm_64_linux_ubuntu_26
 
 PACKAGES_x86_64_linux_debian_11
 PACKAGES_arm_64_linux_debian_11
@@ -41,6 +43,8 @@ PACKAGES_x86_64_linux_ubuntu_22
 PACKAGES_arm_64_linux_ubuntu_22
 PACKAGES_x86_64_linux_ubuntu_24
 PACKAGES_arm_64_linux_ubuntu_24
+PACKAGES_x86_64_linux_ubuntu_26
+PACKAGES_arm_64_linux_ubuntu_26
 
 PACKAGES_x86_64_mingw
 
diff --git a/ci/cfengine-build-host-setup.cf b/ci/cfengine-build-host-setup.cf
index 2672f0ab9..2b78e75d4 100644
--- a/ci/cfengine-build-host-setup.cf
+++ b/ci/cfengine-build-host-setup.cf
@@ -18,7 +18,7 @@ bundle agent cfengine_build_host_setup
     ubuntu_20::
       "autoconf" comment => "because on arm ubuntu-20 we need to reconfigure the debian-9 bootstrapped configure scripts.";
       "shellcheck" comment => "not sure why only ubuntu-20 needed this.";
-    debian.(!debian_12.!ubuntu_22)::
+    debian.(!debian_12.!ubuntu_22.!ubuntu_26)::
       "python" comment => "debian-12 has only python3";
     !(debian_9|ubuntu_16).(debian|ubuntu)::
       "default-jre" comment => "on debian10+ and ubuntu18+ this will be jdk11, good enough for jenkins 2.426.1 https://www.jenkins.io/doc/book/platform-information/support-policy-java/index.html";
diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh
index e41ea2c4b..0f4324451 100755
--- a/ci/setup-cfengine-build-host.sh
+++ b/ci/setup-cfengine-build-host.sh
@@ -24,6 +24,14 @@ function cleanup()
 {
   set -ex
   if command -v apt 2>/dev/null; then
+    # workaround for CFE-4544, remove scriptlets call systemctl even when systemctl is-system-running returns false
+    # Replace systemctl with a no-op stub that always succeeds. We can't
+    # symlink to /bin/echo (or /bin/true): on Ubuntu 26 coreutils is the
+    # single multi-call uutils binary that dispatches on argv[0], so it
+    # would fail with "coreutils: unknown program 'systemctl'".
+    rm -f /bin/systemctl
+    printf '#!/bin/sh\nexit 0\n' > /bin/systemctl
+    chmod +x /bin/systemctl
     apt remove -y cfengine-nova || true
   elif command -v yum 2>/dev/null; then
     yum erase -y cfengine-nova || true