diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78153d5e5..2c3726101 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ env:
 
 jobs:
   config:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     outputs:
       name: ${{ steps.config.outputs.name }}
       version: ${{ steps.config.outputs.version }}
@@ -58,15 +58,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-20.04, macos-11, windows-2022]
         ghc-version: ["8.8.4", "8.10.7", "9.0.2", "9.2.2"]
         exclude:
           # https://gitlab.haskell.org/ghc/ghc/-/issues/18550
-          - os: windows-latest
+          - os: windows-2022
             ghc-version: 8.10.7
-          - os: windows-latest
+          - os: windows-2022
             ghc-version: 9.0.2
-          - os: windows-latest
+          - os: windows-2022
             ghc-version: 9.2.2
     outputs:
       test-lib-json: ${{ steps.test-lib.outputs.targets-json }}
@@ -223,20 +223,20 @@ jobs:
       matrix:
         suite: [test-lib]
         target: ${{ fromJson(needs.build.outputs.test-lib-json) }}
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-20.04, macos-11, windows-2022]
         continue-on-error: [false]
         include:
           - suite: rpc
             target: ''
-            os: ubuntu-latest
+            os: ubuntu-20.04
             continue-on-error: false
           #- suite: rpc
           #  target: ''
-          #  os: macos-latest
+          #  os: macos-11
           #  continue-on-error: false
           #- suite: rpc
           #  target: ''
-          #  os: windows-latest
+          #  os: windows-2022
           #  continue-on-error: true  # TODO: get Python client to work on Windows
     steps:
       - uses: actions/checkout@v2
@@ -301,7 +301,7 @@ jobs:
           cryptol-remote-api/run_rpc_tests.sh
 
   build-push-image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     needs: [config]
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     strategy: