diff --git a/.github/scripts/prepare-vagrant-box-masters.sh b/.github/scripts/prepare-vagrant-box-masters.sh
index 9b92001..75848f4 100755
--- a/.github/scripts/prepare-vagrant-box-masters.sh
+++ b/.github/scripts/prepare-vagrant-box-masters.sh
@@ -70,14 +70,6 @@ write_prewarm_vagrantfile() {
     printf '%s\n' "Vagrant.configure('2') do |config|"
     printf '  config.vm.box = "%s"\n' "$box"
     printf '  config.vm.box_version = "%s"\n' "$version"
-    # generic/ubuntu2204 does not accept Vagrant's bundled insecure key.
-    # Match the repository's Molecule connection settings for the short-lived
-    # prewarm clone so Vagrant can record its linked-clone master.
-    if [[ "$box" == 'generic/ubuntu2204' ]]; then
-      printf '%s\n' \
-        '  config.ssh.username = "vagrant"' \
-        '  config.ssh.password = "vagrant"'
-    fi
     printf '%s\n' \
       '  config.vm.synced_folder ".", "/vagrant", disabled: true' \
       '  config.vm.hostname = "k3s-ansible-box-prewarm"' \
diff --git a/.github/scripts/test-prepare-vagrant-box-masters.sh b/.github/scripts/test-prepare-vagrant-box-masters.sh
index d921d52..22e29c7 100755
--- a/.github/scripts/test-prepare-vagrant-box-masters.sh
+++ b/.github/scripts/test-prepare-vagrant-box-masters.sh
@@ -10,12 +10,12 @@ mock_bin="$fixture/bin"
 mock_state="$fixture/state"
 mock_home="$fixture/home"
 mock_vagrant_home="$fixture/vagrant-home"
-mock_box_dir="$mock_vagrant_home/boxes/generic-VAGRANTSLASH-ubuntu2204/4.3.12/amd64/virtualbox"
+mock_box_dir="$mock_vagrant_home/boxes/bento-VAGRANTSLASH-ubuntu-26.04/202606.01.0/amd64/virtualbox"
 mock_vbox_root="$mock_home/VirtualBox VMs"
 mock_master_root="$mock_home/.cache/k3s-ci/vagrant-masters"
 lock_file="$fixture/vagrant-boxes.lock"
 mkdir -p -- "$mock_bin" "$mock_state" "$mock_box_dir" "$mock_vbox_root"
-printf '%s\n' 'generic/ubuntu2204 4.3.12 amd64' > "$lock_file"
+printf '%s\n' 'bento/ubuntu-26.04 202606.01.0 amd64' > "$lock_file"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-vboxmanage" "$mock_bin/VBoxManage"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-vagrant" "$mock_bin/vagrant"
 ln -s "$repo_root/.github/scripts/test-fixtures/mock-flock" "$mock_bin/flock"
@@ -45,8 +45,6 @@ second_output="$fixture/second-output"
 third_output="$fixture/third-output"
 
 "$script" > "$first_output"
-grep -Fq 'config.ssh.username = "vagrant"' "$MOCK_VAGRANTFILE_CAPTURE"
-grep -Fq 'config.ssh.password = "vagrant"' "$MOCK_VAGRANTFILE_CAPTURE"
 if grep -Fq 'config.ssh.insert_key' "$MOCK_VAGRANTFILE_CAPTURE"; then
   printf 'prewarm Vagrantfile unexpectedly overrides Vagrant SSH key insertion\n' >&2
   exit 1
@@ -54,7 +52,7 @@ fi
 grep -Fq 'virtualbox.memory = 1024' "$MOCK_VAGRANTFILE_CAPTURE"
 grep -Fq 'virtualbox.cpus = 2' "$MOCK_VAGRANTFILE_CAPTURE"
 grep -Fq 'config.vm.boot_timeout = 600' "$MOCK_VAGRANTFILE_CAPTURE"
-mapping_file="$mock_master_root/generic_ubuntu2204-4.3.12-amd64.uuid"
+mapping_file="$mock_master_root/bento_ubuntu-26.04-202606.01.0-amd64.uuid"
 test -s "$mapping_file"
 cmp -s "$mapping_file" "$mock_box_dir/master_id"
 grep -Fq 'Created and recorded owned master' "$first_output"
diff --git a/.github/test-download-boxes.sh b/.github/test-download-boxes.sh
index f036550..39dbaef 100755
--- a/.github/test-download-boxes.sh
+++ b/.github/test-download-boxes.sh
@@ -17,23 +17,29 @@ trap 'rm -rf "$test_root"' EXIT
 printf '%s\n' \
     '#!/usr/bin/env bash' \
     'set -Eeuo pipefail' \
-    'printf "%s\n" generic/debian12 generic/rocky9 generic/ubuntu2204' \
+    'printf "%s\n" bento/debian-13 bento/rockylinux-10.1 bento/ubuntu-26.04' \
     >"$fake_bin/yq"
 
 printf '%s\n' \
     '#!/usr/bin/env bash' \
     'set -Eeuo pipefail' \
     'emit_box() {' \
+    '    case "$1" in' \
+    '        bento/debian-13) version=202510.26.0 ;;' \
+    '        bento/rockylinux-10.1) version=202512.01.0 ;;' \
+    '        bento/ubuntu-26.04) version=202606.01.0 ;;' \
+    '        *) printf "Unexpected box: %s\n" "$1" >&2; exit 1 ;;' \
+    '    esac' \
     '    printf "0,,box-name,%s\n" "$1"' \
     '    printf "0,,box-provider,virtualbox\n"' \
-    '    printf "0,,box-version,4.3.12\n"' \
+    '    printf "0,,box-version,%s\n" "$version"' \
     '    printf "0,,box-architecture,amd64\n"' \
     '}' \
     'if [[ "${1:-}" == box && "${2:-}" == list ]]; then' \
-    '    emit_box generic/debian12' \
-    '    emit_box generic/rocky9' \
+    '    emit_box bento/debian-13' \
+    '    emit_box bento/rockylinux-10.1' \
     '    if [[ "${FAKE_PRESENT_MODE:-all}" == all ]]; then' \
-    '        emit_box generic/ubuntu2204' \
+    '        emit_box bento/ubuntu-26.04' \
     '    fi' \
     'elif [[ "${1:-}" == box && "${2:-}" == add ]]; then' \
     '    printf "%s\n" "$*" >>"${FAKE_VAGRANT_LOG:?}"' \
@@ -55,13 +61,13 @@ PATH="$fake_bin:$PATH" \
     FAKE_VAGRANT_LOG="$fake_log" \
     "$repo_root/.github/download-boxes.sh" >"$output"
 grep -Fxq \
-    'box add --provider virtualbox --box-version 4.3.12 --architecture amd64 generic/ubuntu2204' \
+    'box add --provider virtualbox --box-version 202606.01.0 --architecture amd64 bento/ubuntu-26.04' \
     "$fake_log"
 
 incomplete_lock="$test_root/incomplete.lock"
 printf '%s\n' \
-    'generic/debian12 4.3.12 amd64' \
-    'generic/rocky9 4.3.12 amd64' \
+    'bento/debian-13 202510.26.0 amd64' \
+    'bento/rockylinux-10.1 202512.01.0 amd64' \
     >"$incomplete_lock"
 if PATH="$fake_bin:$PATH" \
     VAGRANT_BOX_LOCK_FILE="$incomplete_lock" \
@@ -71,14 +77,14 @@ if PATH="$fake_bin:$PATH" \
     exit 1
 fi
 grep -Fq 'Scenario boxes missing from the lock file:' "$output"
-grep -Fq 'generic/ubuntu2204' "$output"
+grep -Fq 'bento/ubuntu-26.04' "$output"
 
 duplicate_lock="$test_root/duplicate.lock"
 printf '%s\n' \
-    'generic/debian12 4.3.12 amd64' \
-    'generic/debian12 4.3.11 amd64' \
-    'generic/rocky9 4.3.12 amd64' \
-    'generic/ubuntu2204 4.3.12 amd64' \
+    'bento/debian-13 202510.26.0 amd64' \
+    'bento/debian-13 202508.10.0 amd64' \
+    'bento/rockylinux-10.1 202512.01.0 amd64' \
+    'bento/ubuntu-26.04 202606.01.0 amd64' \
     >"$duplicate_lock"
 if PATH="$fake_bin:$PATH" \
     VAGRANT_BOX_LOCK_FILE="$duplicate_lock" \
diff --git a/.github/vagrant-boxes.lock b/.github/vagrant-boxes.lock
index 76b433b..84fb2f2 100644
--- a/.github/vagrant-boxes.lock
+++ b/.github/vagrant-boxes.lock
@@ -1,4 +1,4 @@
 # box version architecture
-generic/debian12 4.3.12 amd64
-generic/rocky9 4.3.12 amd64
-generic/ubuntu2204 4.3.12 amd64
+bento/debian-13 202510.26.0 amd64
+bento/rockylinux-10.1 202512.01.0 amd64
+bento/ubuntu-26.04 202606.01.0 amd64
diff --git a/README.md b/README.md
index 27b4aab..bbf1dc1 100644
--- a/README.md
+++ b/README.md
@@ -16,9 +16,9 @@ If you want more context on how this works, see:
 
 Build a Kubernetes cluster using Ansible with k3s. The goal is easily install a HA Kubernetes cluster on machines running:
 
-- [x] Debian (tested on version 11)
-- [x] Ubuntu (tested on version 22.04)
-- [x] Rocky (tested on version 9)
+- [x] Debian (tested on version 13)
+- [x] Ubuntu (tested on version 26.04 LTS)
+- [x] Rocky (tested on version 10)
 
 on processor architecture:
 
diff --git a/molecule/calico/molecule.yml b/molecule/calico/molecule.yml
index e4ddb25..70a1357 100644
--- a/molecule/calico/molecule.yml
+++ b/molecule/calico/molecule.yml
@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master
diff --git a/molecule/cilium/molecule.yml b/molecule/cilium/molecule.yml
index 542b6d5..0cbadc9 100644
--- a/molecule/cilium/molecule.yml
+++ b/molecule/cilium/molecule.yml
@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master
diff --git a/molecule/default/molecule.yml b/molecule/default/molecule.yml
index 2f79fc3..aa5efaf 100644
--- a/molecule/default/molecule.yml
+++ b/molecule/default/molecule.yml
@@ -8,7 +8,7 @@ driver:
   parallel: false
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -21,14 +21,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: 192.168.30.38
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: control2
-    box: generic/debian12
+    box: bento/debian-13
     memory: 1024
     cpus: 2
     groups:
@@ -41,7 +36,7 @@ platforms:
         ip: 192.168.30.39
 
   - name: control3
-    box: generic/rocky9
+    box: bento/rockylinux-10.1
     memory: 1024
     cpus: 2
     groups:
@@ -54,7 +49,7 @@ platforms:
         ip: 192.168.30.40
 
   - name: node1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -65,14 +60,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: 192.168.30.41
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: node2
-    box: generic/rocky9
+    box: bento/rockylinux-10.1
     memory: 1024
     cpus: 2
     groups:
diff --git a/molecule/ipv6/molecule.yml b/molecule/ipv6/molecule.yml
index 5c2454e..3ef5cea 100644
--- a/molecule/ipv6/molecule.yml
+++ b/molecule/ipv6/molecule.yml
@@ -5,7 +5,7 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -14,14 +14,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:11
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: control2
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -30,14 +25,9 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:12
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 
   - name: node1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 1024
     cpus: 2
     groups:
@@ -46,11 +36,6 @@ platforms:
     interfaces:
       - network_name: private_network
         ip: fdad:bad:ba55::de:21
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
 provisioner:
   name: ansible
   env:
diff --git a/molecule/kube-vip/molecule.yml b/molecule/kube-vip/molecule.yml
index e4ddb25..70a1357 100644
--- a/molecule/kube-vip/molecule.yml
+++ b/molecule/kube-vip/molecule.yml
@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master
diff --git a/molecule/single_node/molecule.yml b/molecule/single_node/molecule.yml
index c6d45fc..0394268 100644
--- a/molecule/single_node/molecule.yml
+++ b/molecule/single_node/molecule.yml
@@ -5,14 +5,9 @@ driver:
   name: vagrant
 platforms:
   - name: control1
-    box: generic/ubuntu2204
+    box: bento/ubuntu-26.04
     memory: 4096
     cpus: 4
-    config_options:
-      # We currently can not use public-key based authentication on Ubuntu 22.04,
-      # see: https://github.com/chef/bento/issues/1405
-      ssh.username: vagrant
-      ssh.password: vagrant
     groups:
       - k3s_cluster
       - master