diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e619d2c..7d9b9e4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,12 +3,19 @@ on:
   pull_request_target:
     types:
       - labeled
+
 env:
   HOMEBREW_NO_INSTALL_FROM_API: 1
+
+permissions:
+  actions: read
+  contents: write
+  pull-requests: write
+
 jobs:
   pr-pull:
     if: contains(github.event.pull_request.labels.*.name, 'pr-pull')
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         uses: Homebrew/actions/setup-homebrew@master
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a65bbbc..a6582d9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -4,15 +4,17 @@ on:
     branches:
       - main
   pull_request:
+
 env:
   HOMEBREW_NO_INSTALL_FROM_API: 1
   HOMEBREW_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 jobs:
   test-bot:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-11, macos-12, macos-13]
+        os: [ubuntu-latest, macos-12, macos-13]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Set up Homebrew
@@ -30,6 +32,10 @@ jobs:
       # query whether all dependencies are bottled
       - run: brew unbottled Macaulay2
 
+      - name: Install Homebrew Bundler RubyGems
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: brew install-bundler-gems
+
       - run: brew test-bot --only-cleanup-before
 
       - run: brew test-bot --only-setup
@@ -41,7 +47,7 @@ jobs:
 
       - name: Upload bottles as artifact
         if: always() && github.event_name == 'pull_request'
-        uses: actions/upload-artifact@main
+        uses: actions/upload-artifact@v3
         with:
           name: bottles
           path: '*.bottle.*'