diff --git a/.github/workflows/Specs.yml b/.github/workflows/Specs.yml
index ae749e520..3d1fff6f8 100644
--- a/.github/workflows/Specs.yml
+++ b/.github/workflows/Specs.yml
@@ -5,10 +5,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-24.04]
         ruby: [2.6, 2.7, 3.0.0, 3.2.2]
         include:
-          - os: macos-13
+          - os: macos-15
             ruby: system
 
     name: ${{ matrix.os }} / Ruby ${{ matrix.ruby }}
@@ -23,6 +23,26 @@ jobs:
         with:
           ruby-version: ${{ matrix.ruby }}
 
+      # 'system' means Apple's /usr/bin/ruby, NOT the Homebrew Ruby that the
+      # GitHub macOS images put first on PATH. Overwrite PATH with the stock
+      # system directories so none of the image's preinstalled rubies can
+      # shadow /usr/bin/ruby. Apple's default gem home is not writable, so
+      # gems go to ~/.gem (whose bin dir leads the stubbed PATH).
+      - name: Use Apple system Ruby
+        if: ${{ matrix.ruby == 'system' }}
+        run: |
+          echo "GEM_HOME=$HOME/.gem" >> $GITHUB_ENV
+          echo "PATH=$HOME/.gem/bin:/usr/bin:/bin:/usr/sbin:/sbin" >> $GITHUB_ENV
+
+      - name: Verify system Ruby
+        if: ${{ matrix.ruby == 'system' }}
+        run: |
+          ruby --version
+          if [ "$(which ruby)" != "/usr/bin/ruby" ]; then
+            echo "::error::Expected /usr/bin/ruby, got $(which ruby) ($(ruby --version))"
+            exit 1
+          fi
+
       - name: Update git submodules
         run: git submodule update --init
 
@@ -31,8 +51,17 @@ jobs:
 
       - name: Run bundle install
         run: |
+          # Match the Gemfile.lock BUNDLED WITH version; 2.3.26 supports all
+          # matrix Rubies (>= 2.6). For 'system', /usr/bin/gem pins the
+          # binstub to Apple's Ruby.
+          if [ "${{ matrix.ruby }}" = "system" ]; then
+            /usr/bin/gem install bundler -v 2.3.26
+          else
+            gem install bundler -v 2.3.26
+          fi
           bundle config path vendor/bundle
-          bundle install --jobs 4 --retry 3 --without debugging documentation
+          bundle config set without 'debugging documentation'
+          bundle install --jobs 4 --retry 3
 
       - name: Run Specs + Rubocop
         run: bundle exec rake spec