diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6be0c82..9575b0f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,23 +5,24 @@ on:
       - v*
     branches:
       - main
-      - master
       - release-*
   pull_request:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.23.x, 1.24.x]
+        go-version: [1.24.x, 1.25.x]
         libseccomp: ["v2.3.3", "v2.4.4", "v2.5.6", "v2.6.0", "HEAD"]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+
+    runs-on: ${{ matrix.os }}
 
     steps:
 
     - name: checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: build libseccomp ${{ matrix.libseccomp }}
       run: |
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index f6c5b32..f40656a 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -4,7 +4,6 @@ on:
     tags:
       - v*
     branches:
-      - master
       - main
       - release-*
   pull_request:
@@ -14,19 +13,22 @@ jobs:
   lint:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.25.x
       - name: install deps
         run: |
           sudo apt -q update
           sudo apt -q install libseccomp-dev
-      - uses: golangci/golangci-lint-action@v7
+      - uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1
+          version: v2.4
 
   codespell:
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: install deps
       # Version of codespell bundled with Ubuntu will become old, so use pip.
       # OTOH, we want to pin it to specific version to avoid breaking CI.