diff --git a/.github/actions/set-up-legacy-python/action.yml b/.github/actions/set-up-legacy-python/action.yml
new file mode 100644
index 00000000..791c7db8
--- /dev/null
+++ b/.github/actions/set-up-legacy-python/action.yml
@@ -0,0 +1,27 @@
+name: "Set up legacy Python"
+description: "Sets up a specified Python version in a virtual environment using `pyenv`, installs dependencies, and caches the environment"
+inputs:
+  python-version:
+    required: true
+    description: "The Python version to set up"
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/cache@v4
+      id: pyenv-cache
+      with:
+        path: |
+          /opt/hostedtoolcache/pyenv_root/2.4.20/x64/versions/${{ inputs.python-version }}
+        key: ${{ inputs.python-version }}-${{ hashFiles('requirements.txt') }}
+    - name: Set up Python ${{ inputs.python-version }} using pyenv
+      uses: gabrielfalcao/pyenv-action@32ef4d2c861170ce17ded56d10329d83f4c8f797
+      if: steps.pyenv-cache.outputs.cache-hit != 'true'
+      with:
+        default: "${{ inputs.python-version }}"
+        command: pip install -U pip
+    - name: Install dependencies
+      run: |
+        python -m pip install flake8 pytest setuptools wheel
+        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+      shell: bash
diff --git a/.github/workflows/black-format.yml b/.github/workflows/black-format.yml
index 8a22c13a..674bce2d 100644
--- a/.github/workflows/black-format.yml
+++ b/.github/workflows/black-format.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   format:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
         - name: Checks-out repository
           uses: actions/checkout@v4
diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index d08fdda9..f5296bc5 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -11,11 +11,11 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        python-version: [3.12]
+        python-version: ["3.12"]
 
     steps:
     - uses: actions/checkout@v4
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 706809a2..a6b23211 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -10,7 +10,7 @@ on:
 jobs:
   deploy:
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     steps:
     - uses: actions/checkout@v4
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 0650a69a..602bd00e 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -11,14 +11,11 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-20.04
-    env:
-      # Temporary workaround for Python 3.5 failures - May 2024, see CFE-4395
-      PIP_TRUSTED_HOST: "pypi.python.org pypi.org files.pythonhosted.org"
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        python-version: [3.5, 3.6, 3.7, 3.8, 3.9]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
 
     steps:
     - uses: actions/checkout@v4
@@ -49,3 +46,37 @@ jobs:
     - name: Run bash tests
       run: |
         UNSAFE_TESTS=1 bash tests/shell/all.sh
+  test-legacy:
+    runs-on: ubuntu-24.04
+    env:
+      # Temporary workaround for Python 3.5 failures - May 2024, see CFE-4395
+      PIP_TRUSTED_HOST: "pypi.python.org pypi.org files.pythonhosted.org"
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.5.10", "3.6.15", "3.7.10"]
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Set up legacy Python ${{ matrix.python-version }}
+      uses: ./.github/actions/set-up-legacy-python
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Lint with flake8
+      run: |
+        # stop the build if there are Python syntax errors or undefined names
+        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
+        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
+        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+    - name: Test with pytest
+      run: |
+        pytest
+    - name: Install
+      run: |
+        python setup.py sdist bdist_wheel
+        pip install dist/cfbs-*.whl
+    - name: Run bash tests
+      run: |
+        UNSAFE_TESTS=1 bash tests/shell/all.sh
diff --git a/.github/workflows/python-validate-test.yml b/.github/workflows/python-validate-test.yml
index 34c88aef..0de137b4 100644
--- a/.github/workflows/python-validate-test.yml
+++ b/.github/workflows/python-validate-test.yml
@@ -10,29 +10,24 @@ on:
     branches: [ master ]
 
 jobs:
-  test:
-    runs-on: ubuntu-20.04
+  test-legacy:
+    runs-on: ubuntu-24.04
     env:
       # Temporary workaround for Python 3.5 failures - May 2024, see CFE-4395
       PIP_TRUSTED_HOST: "pypi.python.org pypi.org files.pythonhosted.org"
     strategy:
       fail-fast: false
       matrix:
-        python-version: [3.5]
+        python-version: ["3.5.10"]
 
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+    - name: Set up legacy Python ${{ matrix.python-version }}
+      uses: ./.github/actions/set-up-legacy-python
       with:
         python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install flake8 pytest setuptools wheel
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
     - name: Install
       run: |
         python setup.py sdist bdist_wheel