diff --git a/.github/workflows/ci_sh_def.yml b/.github/workflows/ci_sh_def.yml
index 28a2bca9e..fb818761c 100644
--- a/.github/workflows/ci_sh_def.yml
+++ b/.github/workflows/ci_sh_def.yml
@@ -38,7 +38,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runs-on: [ubuntu-latest, windows-2022, macos-latest]
+        runs-on: [ubuntu-20.04, windows-2022, macos-latest]
         python:
         - '3.6'
         - '3.9'
@@ -55,12 +55,12 @@ jobs:
         # We support an optional key: args, for cmake args
         include:
           # Just add a key
-          - runs-on: ubuntu-latest
+          - runs-on: ubuntu-20.04
             python: '3.6'
             args: >
               -DPYBIND11_FINDPYTHON=ON
               -DCMAKE_CXX_FLAGS="-D_=1"
-          - runs-on: ubuntu-latest
+          - runs-on: ubuntu-20.04
             python: 'pypy-3.8'
             args: >
               -DPYBIND11_FINDPYTHON=ON
@@ -210,13 +210,13 @@ jobs:
           python-debug: false
 
     name: "🐍 ${{ matrix.python-version }}${{ matrix.python-debug && '-dbg' || '' }} (deadsnakes)${{ matrix.valgrind && ' • Valgrind' || '' }} • x64"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
 
     steps:
     - uses: actions/checkout@v3
 
     - name: Setup Python ${{ matrix.python-version }} (deadsnakes)
-      uses: deadsnakes/action@v2.1.1
+      uses: deadsnakes/action@v3.0.0
       with:
         python-version: ${{ matrix.python-version }}
         debug: ${{ matrix.python-debug }}
diff --git a/.github/workflows/ci_sh_def.yml.patch b/.github/workflows/ci_sh_def.yml.patch
index 5f45a344a..131999ccf 100644
--- a/.github/workflows/ci_sh_def.yml.patch
+++ b/.github/workflows/ci_sh_def.yml.patch
@@ -1,5 +1,5 @@
---- ci.yml	2022-11-30 23:31:31.956069080 -0800
-+++ ci_sh_def.yml	2022-11-30 23:35:51.259558625 -0800
+--- ci.yml	2022-12-05 14:35:42.960711603 -0800
++++ ci_sh_def.yml	2022-12-05 14:36:16.047712114 -0800
 @@ -1,4 +1,16 @@
 -name: CI
 +# PLEASE KEEP THIS GROUP OF FILES IN SYNC AT ALL TIMES: