diff --git a/.github/workflows/ci_integration.yml b/.github/workflows/ci_integration.yml
index 23836772..38cab2b6 100644
--- a/.github/workflows/ci_integration.yml
+++ b/.github/workflows/ci_integration.yml
@@ -72,7 +72,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          python-version: '3.13'
           
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index 0a780a6b..06e8ce5e 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -24,7 +24,7 @@ jobs:
           # x86 builds are only meaningful for Windows
           - os: windows-latest
             architecture: x86
-          - os: macos-13
+          - os: macos-latest
             architecture: x64
         python:
           - 3.8
@@ -35,6 +35,18 @@ jobs:
 #          - 3.x  3.13 does not have 'pipes' and maybe other necessary things
         category:
           - local-slow
+        exclude:
+          # Python < 3.11 is broken on macOS runners due to missing libintl dependency
+          # See: https://github.com/actions/setup-python/issues/875
+          - platform:
+              os: macos-latest
+            python: 3.8
+          - platform:
+              os: macos-latest
+            python: 3.9
+          - platform:
+              os: macos-latest
+            python: "3.10"
 # These require credentials.
 # Enable them once we sort how to provide them.
 #          - integ-slow
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 3f7e1836..f13598b9 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -5,6 +5,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   call-integration-tests: