diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 242eb66a..4eab36c0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -363,7 +363,7 @@ jobs:
 
   build_macos_x86_64:
     needs: source
-    runs-on: macos-13
+    runs-on: macos-15-intel
     strategy:
       fail-fast: false
       matrix:
@@ -402,7 +402,7 @@ jobs:
     needs:
       - source
       - build_macos_x86_64
-    runs-on: macos-13
+    runs-on: macos-15-intel
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -565,7 +565,7 @@ jobs:
     needs:
       - source
       - repackage_macos_x86_64
-    runs-on: macos-13
+    runs-on: macos-15-intel
     strategy:
       fail-fast: false
       matrix:
diff --git a/Gemfile b/Gemfile
index 261e2d87..27997941 100644
--- a/Gemfile
+++ b/Gemfile
@@ -44,4 +44,16 @@ group :development do
   gem "ruby-lsp", require: false
   gem "simplecov-cobertura"
   gem "yard"
+
+  # Resolves https://github.com/ruby/openssl/issues/949 which we encounter when downloading gocaves on Arm macOS on CI
+  # This has been fixed in openssl versions 3.1.2, 3.2.2, 3.3.1.
+  # Only Ruby 3.3.10 comes with a new enough openssl version by default. We can remove this once Ruby 3.4.8 and 3.2.10
+  # are released.
+  if RUBY_PLATFORM.include?("darwin") && RUBY_PLATFORM.include?("arm64")
+    if RUBY_VERSION.start_with?('3.4')
+      gem "openssl", ">= 3.3.1"
+    elsif RUBY_VERSION.start_with?('3.2', '3.1')
+      gem "openssl", ">= 3.1.2"
+    end
+  end
 end