diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index da534361..756f606d 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -33,12 +33,23 @@ jobs:
   integration-test:
     timeout-minutes: 45
     runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
 
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.2', '8.3', '8.4']
+        php: ['8.2', '8.3', '8.4', '8.5']
         os: [ubuntu-latest]
+        experimental: [false]
+        include:
+          # PHP 8.6 runs as a non-blocking (experimental) leg because
+          # its packages can lag on the runners and in Ondřej Surý's PPA.
+          # Pinned to Ubuntu 24.04 (Noble): ubuntu-latest is now Ubuntu 26.04
+          # (Resolute), which Ondrej Sury's PPA does not yet serve, so the 8.6
+          # PPA toolchain install 404s. Noble carries the latest packaged 8.6 RC.
+          - php: '8.6'
+            os: ubuntu-24.04
+            experimental: true
 
     services:
       mariadb:
@@ -76,6 +87,7 @@ jobs:
         fetch-depth: 0
 
     - name: Install PHP ${{ matrix.php }}
+      if: matrix.php != '8.6'
       uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
       with:
         php-version: ${{ matrix.php }}
@@ -84,6 +96,41 @@ jobs:
         coverage: xdebug
         ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York"
 
+    # PHP 8.6 is still pre-release. shivammathur/setup-php ships a nightly
+    # 8.6.0-dev build whose bundled extensions are ABI-skewed against their own
+    # core (undefined symbol: smart_str_ferealloc / _safe_femalloc), so every
+    # extension fails to load and the CLI install dies. Ondřej Surý's PPA
+    # provides a coherent 8.6 RC build, so this experimental leg provisions the
+    # CLI from there instead.
+    - name: Install PHP 8.6 toolchain from Ondřej Surý's PPA
+      if: matrix.php == '8.6'
+      run: |
+        set -euo pipefail
+        sudo add-apt-repository -y ppa:ondrej/php
+        sudo apt-get update
+        sudo apt-get install -y \
+          php8.6-cli php8.6-common \
+          php8.6-intl php8.6-mysql php8.6-gd php8.6-ldap \
+          php8.6-gmp php8.6-xml php8.6-curl php8.6-mbstring \
+          php8.6-snmp php8.6-sqlite3
+        # Make the Ondřej 8.6 CLI the default `php` so composer and the tests
+        # run under the same ABI-coherent build.
+        sudo update-alternatives --install /usr/bin/php php /usr/bin/php8.6 86
+        sudo update-alternatives --set php /usr/bin/php8.6
+        # Mirror the ini values the other legs receive via setup-php.
+        printf '%s\n' \
+          'post_max_size=256M' \
+          'max_execution_time=60' \
+          'date.timezone=America/New_York' \
+          | sudo tee /etc/php/8.6/cli/conf.d/99-cacti-ci.ini >/dev/null
+        # setup-php normally provides Composer; it is skipped for this leg, so
+        # make sure a Composer binary is available for the dependency steps.
+        if ! command -v composer >/dev/null 2>&1; then
+          sudo apt-get install -y composer
+        fi
+        php -v
+        composer --version
+
     - name: Check PHP version
       run: php -v
 
@@ -203,7 +250,9 @@ jobs:
     # inside a live Cacti. What is enforceable is that a change covers the
     # lines it adds.
     - name: Enforce coverage of changed lines
-      if: github.event_name == 'pull_request'
+      # PHP 8.6 installs from the Ondřej PPA, which has no matching xdebug
+      # build yet, so there is no coverage driver on that experimental leg.
+      if: github.event_name == 'pull_request' && matrix.php != '8.6'
       env:
         BASE_REF: ${{ github.event.pull_request.base.sha }}
       run: |
@@ -260,7 +309,7 @@ jobs:
     - name: Run Cacti Poller
       run: |
         cd ${{ github.workspace }}/cacti
-        sudo -u www-data php poller.php --poller=1 --force --debug
+        sudo runuser -u www-data -g runner -- php poller.php --poller=1 --force --debug
 
         if ! grep -q "SYSTEM STATS" log/cacti.log; then
           echo "Cacti poller did not finish successfully"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5cf3ffdc..954159d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 --- develop ---
 
+* dev: Run the CI poller with the shared runner group so RRD files and structured directories pass permission verification
 * issue: Remove the Listener and Stream from the report page.  They are part of what a Filter materializes, so changing them there ran the report against data that was never materialized.  They are now set only in the Filter editor, and the report page reads them straight from the saved Filter.  The New button now follows Edit.
 
 * issue: Start a materialization automatically when a Filter is saved with a change that affects its cached results, from either the Filter editor or the FlowView tab, and say so, instead of asking the user to start one by hand from the Filters page.