diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 68a68b9e146693..9642af44b7d354 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -382,7 +382,7 @@ jobs:
     build_darwin:
         name: Build on Darwin (clang, python_lib, simulated)
         timeout-minutes: 200
-        runs-on: macos-latest
+        runs-on: macos-13
         if: github.actor != 'restyled-io[bot]'
 
         steps:
diff --git a/.github/workflows/darwin-tests.yaml b/.github/workflows/darwin-tests.yaml
index 628e88d767d4dd..d426ac1c0b69a9 100644
--- a/.github/workflows/darwin-tests.yaml
+++ b/.github/workflows/darwin-tests.yaml
@@ -42,7 +42,7 @@ jobs:
             LSAN_OPTIONS: detect_leaks=1 malloc_context_size=40 suppressions=scripts/tests/chiptest/lsan-mac-suppressions.txt
 
         if: github.actor != 'restyled-io[bot]'
-        runs-on: macos-latest
+        runs-on: macos-13
 
         steps:
             - uses: Wandalen/wretry.action@v1.0.36
diff --git a/.github/workflows/darwin.yaml b/.github/workflows/darwin.yaml
index ce733a89d0c9e8..2538d0cd5f9b55 100644
--- a/.github/workflows/darwin.yaml
+++ b/.github/workflows/darwin.yaml
@@ -30,7 +30,7 @@ jobs:
         timeout-minutes: 210
 
         if: github.actor != 'restyled-io[bot]'
-        runs-on: macos-latest
+        runs-on: macos-13
 
         steps:
             - uses: Wandalen/wretry.action@v1.0.36
diff --git a/.github/workflows/fuzzing-build.yaml b/.github/workflows/fuzzing-build.yaml
index fd857c00c933c1..7df1261bedb431 100644
--- a/.github/workflows/fuzzing-build.yaml
+++ b/.github/workflows/fuzzing-build.yaml
@@ -95,7 +95,7 @@ jobs:
     build_darwin_fuzzing:
         name: Build on Darwin
         timeout-minutes: 90
-        runs-on: macos-latest
+        runs-on: macos-13
         if: github.actor != 'restyled-io[bot]'
 
         steps:
diff --git a/.github/workflows/smoketest-darwin.yaml b/.github/workflows/smoketest-darwin.yaml
index e0ce15b7232740..0e0ce4aecdd912 100644
--- a/.github/workflows/smoketest-darwin.yaml
+++ b/.github/workflows/smoketest-darwin.yaml
@@ -30,7 +30,7 @@ jobs:
         timeout-minutes: 60
 
         if: github.actor != 'restyled-io[bot]'
-        runs-on: macos-latest
+        runs-on: macos-13
 
         steps:
             - uses: Wandalen/wretry.action@v1.0.36
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 9c313a8b2adc18..35952a62464f8a 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -312,7 +312,7 @@ jobs:
             LSAN_OPTIONS: detect_leaks=1 suppressions=scripts/tests/chiptest/lsan-mac-suppressions.txt
 
         if: github.actor != 'restyled-io[bot]'
-        runs-on: macos-latest
+        runs-on: macos-13
 
         steps:
             - uses: Wandalen/wretry.action@v1.0.36
@@ -700,7 +700,7 @@ jobs:
             TSAN_OPTIONS: "halt_on_error=1"
 
         if: github.actor != 'restyled-io[bot]' && false
-        runs-on: macos-latest
+        runs-on: macos-13
 
         steps:
             - name: Checkout
diff --git a/scripts/setup/constraints.txt b/scripts/setup/constraints.txt
index 892e91964add26..c722ba1b0ac91f 100644
--- a/scripts/setup/constraints.txt
+++ b/scripts/setup/constraints.txt
@@ -130,7 +130,7 @@ greenlet==2.0.2
     # via gevent
 humanfriendly==10.0
     # via coloredlogs
-idf-component-manager==1.2.2
+idf-component-manager==1.5.2
     # via -r requirements.esp32.txt
 idna==3.4
     # via requests
@@ -234,9 +234,6 @@ portpicker==1.5.2
     #   -r requirements.txt
     #   mobly
 prettytable==2.5.0
-    # via
-    #   mbed-ls
-    #   mbed-os-tools
 prompt-toolkit==3.0.43
     # via ipython
 protobuf==3.20.1
@@ -419,3 +416,9 @@ wheel==0.38.4 ; sys_platform == "linux"
 # The following packages are considered to be unsafe in a requirements file:
 # pip
 # setuptools
+#
+# Manual edits:
+# Higher versions depend on proto-plus, which break
+# nanopb code generation (due to name conflict of the 'proto' module)
+google-api-core==2.17.0
+