diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77754f34..971bf787 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,11 @@ jobs:
     name: Build and Test
     strategy:
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - macos-14
+          - windows-latest
         scala: [2.12]
         java:
           - temurin@8
@@ -55,6 +59,8 @@ jobs:
         exclude:
           - java: temurin@11
             os: macos-latest
+          - java: temurin@11
+            os: macos-14
           - java: temurin@11
             os: windows-latest
           - java: temurin@17
@@ -63,23 +69,38 @@ jobs:
             os: windows-latest
           - java: graal_22.3.2@11
             os: macos-latest
+          - java: graal_22.3.2@11
+            os: macos-14
           - java: graal_22.3.2@11
             os: windows-latest
           - java: graalvm@17
             os: macos-latest
+          - java: graalvm@17
+            os: macos-14
           - java: graalvm@17
             os: windows-latest
           - java: corretto@17
             os: macos-latest
+          - java: corretto@17
+            os: macos-14
           - java: corretto@17
             os: windows-latest
           - java: semeru@17
             os: macos-latest
+          - java: semeru@17
+            os: macos-14
           - java: semeru@17
             os: windows-latest
+          - java: temurin@8
+            os: macos-14
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
+      - name: Install sbt
+        if: contains(runner.os, 'macos')
+        shell: bash
+        run: brew install sbt
+
       - name: Ignore line ending differences in git
         if: contains(runner.os, 'windows')
         shell: bash
@@ -244,6 +265,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 45
     steps:
+      - name: Install sbt
+        if: contains(runner.os, 'macos')
+        run: brew install sbt
+
       - name: Ignore line ending differences in git
         if: contains(runner.os, 'windows')
         run: git config --global core.autocrlf false
@@ -387,6 +412,10 @@ jobs:
         java: [temurin@8]
     runs-on: ${{ matrix.os }}
     steps:
+      - name: Install sbt
+        if: contains(runner.os, 'macos')
+        run: brew install sbt
+
       - name: Ignore line ending differences in git
         if: contains(runner.os, 'windows')
         run: git config --global core.autocrlf false
@@ -526,6 +555,10 @@ jobs:
         java: [temurin@11]
     runs-on: ${{ matrix.os }}
     steps:
+      - name: Install sbt
+        if: contains(runner.os, 'macos')
+        run: brew install sbt
+
       - name: Ignore line ending differences in git
         if: contains(runner.os, 'windows')
         run: git config --global core.autocrlf false
diff --git a/.mergify.yml b/.mergify.yml
index db3438bc..6bba5ca4 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -20,6 +20,7 @@ pull_request_rules:
   - status-success=Build and Test (ubuntu-latest, 2.12, corretto@17, sbt-typelevelJVM)
   - status-success=Build and Test (ubuntu-latest, 2.12, semeru@17, sbt-typelevelJVM)
   - status-success=Build and Test (macos-latest, 2.12, temurin@8, sbt-typelevelJVM)
+  - status-success=Build and Test (macos-14, 2.12, temurin@17, sbt-typelevelJVM)
   - status-success=Build and Test (windows-latest, 2.12, temurin@8, sbt-typelevelJVM)
   - status-success=Validate Steward Config (ubuntu-latest, temurin@11)
   - status-success=Generate Site (ubuntu-latest, temurin@11)
diff --git a/build.sbt b/build.sbt
index 7a74814c..39a7570f 100644
--- a/build.sbt
+++ b/build.sbt
@@ -12,22 +12,30 @@ ThisBuild / developers ++= List(
 )
 ThisBuild / startYear := Some(2022)
 
+val temurin8 = JavaSpec.temurin("8")
+val temurin17 = JavaSpec.temurin("17")
+
 ThisBuild / githubWorkflowJavaVersions ++= Seq(
   JavaSpec.temurin("11"),
-  JavaSpec.temurin("17"),
+  temurin17,
   JavaSpec(JavaSpec.Distribution.GraalVM("22.3.2"), "11"),
   JavaSpec.graalvm("17"),
   JavaSpec.corretto("17"),
   JavaSpec.semeru("17")
 )
 
-ThisBuild / githubWorkflowOSes ++= Seq("macos-latest", "windows-latest")
+val macos14 = "macos-14"
+
+ThisBuild / githubWorkflowOSes ++= Seq("macos-latest", macos14, "windows-latest")
 
 ThisBuild / githubWorkflowBuildMatrixExclusions ++= {
-  for {
+  val exclusions = for {
     java <- githubWorkflowJavaVersions.value.tail
     os <- githubWorkflowOSes.value.tail
+    if !(java == temurin17 && os == macos14) // keep this one
   } yield MatrixExclude(Map("java" -> java.render, "os" -> os))
+
+  exclusions :+ MatrixExclude(Map("java" -> temurin8.render, "os" -> macos14))
 }
 
 ThisBuild / githubWorkflowPublishTimeoutMinutes := Some(45)
diff --git a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
index 7d577ade..c27b9dff 100644
--- a/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
+++ b/github-actions/src/main/scala/org/typelevel/sbt/gha/GenerativePlugin.scala
@@ -659,6 +659,7 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
   private lazy val internalTargetAggregation =
     settingKey[Seq[File]]("Aggregates target directories from all subprojects")
 
+  private val macosGuard = Some("contains(runner.os, 'macos')")
   private val windowsGuard = Some("contains(runner.os, 'windows')")
 
   private val PlatformSep = FileSystems.getDefault.getSeparator
@@ -775,6 +776,14 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
     },
     githubWorkflowGeneratedCacheSteps := Seq(),
     githubWorkflowJobSetup := {
+      val brewInstallSbtOpt = if (githubWorkflowOSes.value.exists(_.contains("macos"))) {
+        List(
+          WorkflowStep
+            .Run(List("brew install sbt"), name = Some("Install sbt"), cond = macosGuard))
+      } else {
+        Nil
+      }
+
       val autoCrlfOpt = if (githubWorkflowOSes.value.exists(_.contains("windows"))) {
         List(
           WorkflowStep.Run(
@@ -785,7 +794,8 @@ ${indent(jobs.map(compileJob(_, sbt)).mkString("\n\n"), 1)}
         Nil
       }
 
-      autoCrlfOpt :::
+      brewInstallSbtOpt :::
+        autoCrlfOpt :::
         List(WorkflowStep.CheckoutFull) :::
         WorkflowStep.SetupJava(githubWorkflowJavaVersions.value.toList) :::
         githubWorkflowGeneratedCacheSteps.value.toList