diff --git a/.github/workflows/validate-openapi.yml b/.github/workflows/validate-openapi.yml
index b7cce206..ecafcf84 100644
--- a/.github/workflows/validate-openapi.yml
+++ b/.github/workflows/validate-openapi.yml
@@ -12,14 +12,19 @@ jobs:
     services:
       # Label used to access the service container
       swagger-editor:
-        # Docker Hub image
-        image: swaggerapi/swagger-editor
+        # Docker Hub image. Pinned to v4: `latest` is now SwaggerEditor 5, which
+        # serves on port 80 and lacks the v4 error panel the validator reads.
+        image: swaggerapi/swagger-editor:v4.14.8
         ports:
           # Maps port 8080 on service container to the host 80
           - 80:8080
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
+      # Ubuntu 24.04 runners block the unprivileged user namespaces Chromium's
+      # sandbox needs, so the validator's headless browser fails to launch.
+      - name: Allow Chromium sandbox
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Validate OpenAPI definition
         uses: char0n/swagger-editor-validate@v1
         with: