diff --git a/.github/workflows/app-build-verify.yml b/.github/workflows/app-build-verify.yml
index 1d0ba244..2ae18f92 100644
--- a/.github/workflows/app-build-verify.yml
+++ b/.github/workflows/app-build-verify.yml
@@ -133,7 +133,7 @@ jobs:
       # fall back to the system-provided Python package. Providing "system" as a value
       # on macOS or Windows will cause an error.
       if: ${{ !startsWith(inputs.runner-os, 'ubuntu') || inputs.python-version != 'system' }}
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@v6.3.0
       with:
         # This needs to be kept aligned with the input default value
         python-version: ${{ inputs.python-version || '3.13' }}
diff --git a/.github/workflows/app-create-verify.yml b/.github/workflows/app-create-verify.yml
index 69fcde6e..f2afd27c 100644
--- a/.github/workflows/app-create-verify.yml
+++ b/.github/workflows/app-create-verify.yml
@@ -77,7 +77,7 @@ jobs:
       # Python matching the system version. We can't use the actual system
       # install because we need to install dependencies, which would either
       # require the use of sudo, or extra workarounds for user-space packages.
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@v6.3.0
       with:
         python-version: ${{ startsWith(inputs.runner-os, 'ubuntu') && inputs.python-version == 'system' && steps.config.outputs.system-python-version || inputs.python-version || '3.x' }}
         cache: pip
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 694a3235..7c98c60e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,7 +108,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Set up Python
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@v6.3.0
       with:
         python-version: "3.x"
         cache: pip
@@ -195,7 +195,7 @@ jobs:
       fail-fast: false
       matrix:
         framework: [ toga, pyside6 ]
-        runner-os: [ macos-latest, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
+        runner-os: [ macos-15, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
 
   test-verify-apps-briefcase:
     name: Verify Briefcase
@@ -211,7 +211,7 @@ jobs:
       fail-fast: false
       matrix:
         framework: [ toga ]
-        runner-os: [ macos-15-intel, macos-latest, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
+        runner-os: [ macos-15-intel, macos-15, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
 
   test-verify-apps-briefcase-template:
     name: Verify Briefcase Template
@@ -226,7 +226,7 @@ jobs:
       fail-fast: false
       matrix:
         framework: [ toga ]
-        runner-os: [ macos-latest, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
+        runner-os: [ macos-15, windows-latest, ubuntu-24.04, ubuntu-24.04-arm ]
 
   test-verify-apps-android-templates:
     name: Verify Android
@@ -242,7 +242,7 @@ jobs:
       fail-fast: false
       matrix:
         framework: [ toga ]  # toga only
-        runner-os: [ macos-latest, windows-latest, ubuntu-24.04 ]
+        runner-os: [ macos-15, windows-latest, ubuntu-24.04 ]
 
   test-verify-apps-iOS-templates:
     name: Verify iOS
@@ -250,7 +250,7 @@ jobs:
     uses: ./.github/workflows/app-build-verify.yml
     with:
       repository: beeware/briefcase-iOS-xcode-template
-      runner-os: macos-latest
+      runner-os: macos-15
       target-platform: iOS
       target-format: xcode
       framework: ${{ matrix.framework }}
@@ -322,7 +322,7 @@ jobs:
     uses: ./.github/workflows/app-build-verify.yml
     with:
       repository: beeware/briefcase-macos-${{ matrix.format }}-template
-      runner-os: macos-latest
+      runner-os: macos-15
       target-platform: macOS
       target-format: ${{ matrix.format }}
       framework: ${{ matrix.framework }}
diff --git a/.github/workflows/pre-commit-run.yml b/.github/workflows/pre-commit-run.yml
index 8298a78b..10cdaead 100644
--- a/.github/workflows/pre-commit-run.yml
+++ b/.github/workflows/pre-commit-run.yml
@@ -41,7 +41,7 @@ jobs:
         repository: ${{ inputs.repository }}
 
     - name: Set up Python
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
         allow-prereleases: true
diff --git a/.github/workflows/towncrier-run.yml b/.github/workflows/towncrier-run.yml
index bae65404..6ebbb16f 100644
--- a/.github/workflows/towncrier-run.yml
+++ b/.github/workflows/towncrier-run.yml
@@ -55,7 +55,7 @@ jobs:
         fetch-depth: 0
 
     - name: Setup Python
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
         allow-prereleases: true