diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f0baa11b2b..228a37c583 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,13 +13,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     name: Test
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-24.04, windows-2022, macOS-latest ]
+        os: [ ubuntu-latest, windows-latest, macOS-latest ]
     runs-on: ${{ matrix.os }}
     env:
       RUSTUP_UNPACK_RAM: "26214400"
@@ -79,7 +81,7 @@ jobs:
     name: Android
     strategy:
       matrix:
-        os: [ ubuntu-24.04 ]
+        os: [ ubuntu-latest ]
         target: [ aarch64-linux-android ]
     runs-on: ${{ matrix.os }}
     env:
@@ -127,7 +129,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-24.04, windows-2022, macOS-latest ]
+        os: [ ubuntu-latest, windows-latest, macOS-latest ]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -150,7 +152,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-24.04, windows-2022, macOS-latest ]
+        os: [ ubuntu-latest, windows-latest, macOS-latest ]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
@@ -165,12 +167,13 @@ jobs:
           # FIXME(eddyb) consider using lavapipe instead, or even trying both.
           install_swiftshader: true
           # install_lavapipe: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - if: ${{ runner.os == 'Windows' }}
-        name: Windows - Use SwiftShader as Vulkan driver
-        # FIXME(eddyb) ideally `jakoch/install-vulkan-sdk-action` should do this.
+        name: Windows - Register Driver in Registry
+        shell: pwsh
         run: |
-          echo "C:/Swiftshader/" >> "$GITHUB_PATH"
-          echo "VK_DRIVER_FILES=C:/Swiftshader/vk_swiftshader_icd.json" >> "$GITHUB_ENV"
+          reg add "HKLM\SOFTWARE\Khronos\Vulkan\Drivers" /v "$env:VK_DRIVER_FILES" /t REG_DWORD /d 0 /f
       - if: ${{ runner.os == 'Linux' }}
         name: Linux - Install native dependencies
         run: sudo apt install libwayland-cursor0 libxkbcommon-dev libwayland-dev
@@ -195,7 +198,7 @@ jobs:
   # This allows us to have a single job we can branch protect on, rather than needing
   # to update the branch protection rules when the test matrix changes
   test_success:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: [test, compiletest, difftest, android, lint, cargo-deny]
     # Hack for buggy GitHub Actions behavior with skipped checks: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
     if: ${{ always() }}
@@ -212,7 +215,7 @@ jobs:
 
   lint:
     name: Lint
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       # Note that we are explicitly NOT checking out submodules, to validate
       # that we haven't accidentally enabled spirv-tools native compilation
@@ -254,7 +257,7 @@ jobs:
         run: .github/workflows/lint.sh
 
   cargo-deny:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: EmbarkStudios/cargo-deny-action@v2