diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 82ea24a151..3e4211eebb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -14,17 +14,26 @@ concurrency:
 
 jobs:
   test:
-    name: Test (Node ${{ matrix.node-version }})
-    runs-on: ubuntu-latest
+    name: Test (${{ matrix.os }}, Node ${{ matrix.node-version }})
+    runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [ '20.x', '22.x' ]
+        os: [ ubuntu-latest ]
+        node-version: [ '20.x', '22.x', '24.x' ]
+        include:
+          # A darwin leg is what covers the iOS-specific suites - they are gated
+          # on the platform and never execute anywhere else. One version is
+          # enough for that; 24 is the active LTS.
+          - os: macos-latest
+            node-version: '24.x'
 
     steps:
 
       - name: Harden the runner (Audit all outbound calls)
+        # only supported on the Ubuntu runners
+        if: runner.os == 'Linux'
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit