diff --git a/.github/workflows/drivers.yaml b/.github/workflows/drivers.yaml
index c425d4c6..78efcdea 100644
--- a/.github/workflows/drivers.yaml
+++ b/.github/workflows/drivers.yaml
@@ -4,7 +4,7 @@ on: [push, pull_request]
 jobs:
   build_socketcan:
     name: socketcan build
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v2
diff --git a/.github/workflows/repo.yml b/.github/workflows/repo.yml
index 1e3dcf9c..1191aaf9 100644
--- a/.github/workflows/repo.yml
+++ b/.github/workflows/repo.yml
@@ -8,7 +8,7 @@ on:
 jobs:
   pre-commit-autoupdate:
     name: pre-commit autoupdate
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     container:
       image: ghcr.io/commaai/panda:latest
     steps:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 1319ebaf..97c9e07f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -21,7 +21,7 @@ env:
 jobs:
   docker_push:
     name: docker push
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/panda'
     steps:
@@ -38,7 +38,7 @@ jobs:
 
   build:
     name: build
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v2
@@ -57,7 +57,7 @@ jobs:
 
   unit_tests:
     name: unit tests
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v2
@@ -70,7 +70,7 @@ jobs:
 
   safety:
     name: safety
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         flags: ['', '--ubsan']
@@ -82,16 +82,13 @@ jobs:
       - name: Run safety tests
         timeout-minutes: 5
         run: |
-          ${{ env.RUN }} "cd .. && \
-                          scons -c && \
-                          scons -j$(nproc) opendbc/ cereal/ && \
-                          cd panda && \
+          ${{ env.RUN }} "scons -c -j$(nproc) && \
                           scons -j$(nproc) ${{ matrix.flags }} && \
                           tests/safety/test.sh"
 
   misra:
     name: MISRA C:2012
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v2
@@ -108,7 +105,7 @@ jobs:
 
   python_linter:
     name: python linter
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v2
diff --git a/Dockerfile b/Dockerfile
index ffd5a00a..74afcb6b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,44 +1,36 @@
-FROM ubuntu:20.04
+FROM ubuntu:24.04
+
 ENV PYTHONUNBUFFERED 1
 ENV PYTHONPATH /tmp/openpilot:$PYTHONPATH
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    autoconf \
-    automake \
+    make \
     bzip2 \
     ca-certificates \
     capnproto \
     clang \
-    curl \
     g++ \
     gcc-arm-none-eabi libnewlib-arm-none-eabi \
     git \
     libarchive-dev \
-    libavformat-dev libavcodec-dev libavdevice-dev libavutil-dev libswscale-dev libavresample-dev libavfilter-dev \
     libbz2-dev \
     libcapnp-dev \
-    libcurl4-openssl-dev \
     libffi-dev \
     libtool \
-    libssl-dev \
-    libsqlite3-dev \
     libusb-1.0-0 \
     libzmq3-dev \
     locales \
     opencl-headers \
     ocl-icd-opencl-dev \
-    make \
-    patch \
-    pkg-config \
-    python \
-    python-dev \
-    qt5-default \
-    unzip \
-    wget \
+    python3 \
+    python3-dev \
+    python3-pip \
+    python-is-python3 \
     zlib1g-dev \
  && rm -rf /var/lib/apt/lists/* && \
-    cd /usr/lib/gcc/arm-none-eabi/9.2.1 && \
+    apt clean && \
+    cd /usr/lib/gcc/arm-none-eabi/* && \
     rm -rf arm/ && \
     rm -rf thumb/nofp thumb/v6* thumb/v8* thumb/v7+fp thumb/v7-r+fp.sp
 
@@ -47,45 +39,27 @@ ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US:en
 ENV LC_ALL en_US.UTF-8
 
-RUN curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
-ENV PATH="/root/.pyenv/bin:/root/.pyenv/shims:${PATH}"
-
-ENV PANDA_PATH=/tmp/openpilot/panda
-ENV OPENPILOT_REF="bc4b75822a609e6897058bc83688c84004f29093"
-ENV OPENDBC_REF="1745ab51825055cd18748013c4a5e3377319e390"
-
 COPY requirements.txt /tmp/
-RUN pyenv install 3.11.4 && \
-    pyenv global 3.11.4 && \
-    pyenv rehash && \
-    pip install --no-cache-dir -r /tmp/requirements.txt
+RUN pip3 install --break-system-packages --no-cache-dir -r /tmp/requirements.txt
 
 ENV CPPCHECK_DIR=/tmp/cppcheck
 COPY tests/misra/install.sh /tmp/
-RUN /tmp/install.sh
-# don't try to install again
+RUN /tmp/install.sh && rm -rf $CPPCHECK_DIR/.git/
 ENV SKIP_CPPCHECK_INSTALL=1
 
+ENV CEREAL_REF="861144c136c91f70dcbc652c2ffe99f57440ad47"
+ENV OPENDBC_REF="e0d4be4a6215d44809718dc84efe1b9f0299ad63"
+
 RUN git config --global --add safe.directory /tmp/openpilot/panda
-RUN cd /tmp && \
-    git clone https://github.com/commaai/openpilot.git tmppilot || true && \
-    cd /tmp/tmppilot && \
-    git fetch origin $OPENPILOT_REF && \
-    git checkout $OPENPILOT_REF && \
-    git submodule update --init cereal opendbc rednose_repo body && \
-    git -C opendbc fetch && \
-    git -C opendbc checkout $OPENDBC_REF && \
-    git -C opendbc reset --hard HEAD && \
-    git -C opendbc clean -xfd && \
-    mkdir /tmp/openpilot && \
-    cp -pR SConstruct site_scons/ tools/ selfdrive/ system/ common/ cereal/ opendbc/ rednose/ third_party/ body/ /tmp/openpilot && \
-    rm -rf /tmp/openpilot/panda && \
-    rm -rf /tmp/tmppilot
-
-RUN cd /tmp/openpilot && \
-    pip install --no-cache-dir -r opendbc/requirements.txt && \
-    pip install --no-cache-dir --upgrade aenum lru-dict pycurl tenacity atomicwrites serial smbus2
-
+RUN mkdir -p /tmp/openpilot/ && \
+    cd /tmp/openpilot/ && \
+    git clone --depth 1 https://github.com/commaai/cereal && \
+    git clone --depth 1 https://github.com/commaai/opendbc && \
+    cd cereal && git fetch origin $CEREAL_REF && git checkout FETCH_HEAD && rm -rf .git/ && cd .. && \
+    cd opendbc && git fetch origin $OPENDBC_REF && git checkout FETCH_HEAD && rm -rf .git/ && cd .. && \
+    cp -pR opendbc/SConstruct opendbc/site_scons/ . && \
+    pip3 install --break-system-packages --no-cache-dir -r opendbc/requirements.txt && \
+    scons -j8 --minimal opendbc/ cereal/
 
 # for Jenkins
 COPY README.md panda.tar.* /tmp/
diff --git a/board/debug/README.md b/board/debug/README.md
index d89eab81..d475ce90 100644
--- a/board/debug/README.md
+++ b/board/debug/README.md
@@ -11,7 +11,7 @@ Connect an ST-Link V2 programmer to the SWD pins on the board. The pins that nee
 Make sure you're using a genuine one for boards that do not have a 3.3V panda power rail. For example, the tres runs at 1.8V, which is not supported by the clones.
 
 ## Openocd
-Install openocd. For Ubuntu 20.04, the one in the package manager works fine: `sudo apt install openocd`.
+Install openocd. For Ubuntu 24.04, the one in the package manager works fine: `sudo apt install openocd`.
 
 To run, use `./debug_f4.sh (TODO)` or `./debug_h7.sh` depending on the panda.