diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cbacec1..d0cf06c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ permissions:
   contents: read
 jobs:
   release:
-    runs-on: macos-12
+    runs-on: macos-15-large
     # The maximum access is "read" for PRs from public forked repos
     # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
     permissions:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 189e92b..37be3d6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,11 +14,12 @@ jobs:
   integration:
     name: Integration tests
     strategy:
+      fail-fast: false
       matrix:
         # macos-13-large is used as macos-13 seems too flaky.
-        # macos-14 (ARM) cannot be used for the most part of the job
+        # macos-{14, 15, ...} (ARM) cannot be used for the most part of the job
         # due to the lack of the support for nested virt.
-        platform: [macos-12, macos-13-large]
+        platform: [macos-13-large, macos-14-large, macos-15-large]
     runs-on: ${{ matrix.platform }}
     timeout-minutes: 40
     steps:
@@ -30,6 +31,13 @@ jobs:
           uname -a
           sw_vers
           ifconfig
+      # FIXME: do not completely disable firewall
+      - name: Disable firewall
+        run: |
+          set -eux
+          sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode off
+          sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
+          sudo defaults write /Library/Preferences/com.apple.alf globalstate -bool false
       - name: Make Install (x86_64)
         run: |
           # compile for x86_64