diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7d2917..de626c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,10 +18,15 @@ jobs:
       fail-fast: false
       matrix:
         # Pin macOS to macos-14 (Sonoma): the rolling `macos-latest` image
-        # intermittently ships a broken compiler-rt path ("ld: library
-        # 'clang_rt.osx' not found"), which fails the Rust link step on an
-        # otherwise-green commit. macos-14 has a stable Xcode/clang toolchain.
-        os: [macos-14, ubuntu-latest]
+        # The "ld: library 'clang_rt.osx' not found" failure is NOT a flaky
+        # image. It is the linker resolving a clang compiler-rt search path
+        # (Xcode .../clang/<N>/lib/darwin) that no longer exists on the runner,
+        # because a STALE `target/` was restored from the cache after the
+        # runner image's default Xcode moved. The real fix is the cache change
+        # below (we no longer cache `target/`, and the key is bumped to v2 to
+        # discard the poisoned caches), so the runner choice is no longer
+        # load-bearing. macos-latest is fine again with a clean target dir.
+        os: [macos-latest, ubuntu-latest]
     steps:
       - uses: actions/checkout@v4
 
@@ -30,17 +35,20 @@ jobs:
         with:
           components: clippy
 
-      - name: Cache cargo
+      - name: Cache cargo (registry only)
         uses: actions/cache@v4
         with:
+          # Deliberately NOT caching `target/`: a `target/` built against a
+          # different Xcode carries a stale clang compiler-rt search path that
+          # breaks the linker ("clang_rt.osx not found"). Cache only the
+          # download-heavy registry/git dirs; recompiling is cheap and correct.
           path: |
             ~/.cargo/bin/
             ~/.cargo/registry/index/
             ~/.cargo/registry/cache/
             ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
+          key: ${{ runner.os }}-cargo-v2-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-v2-
 
       - name: Check
         run: cargo check --workspace
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3741d29..d789b12 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,11 +39,11 @@ jobs:
           # consumers must `brew install onnxruntime` before running — see
           # INSTALL-INTEL-MAC.md bundled in the tarball.
           - target: x86_64-apple-darwin
-            os: macos-14
+            os: macos-latest
             archive: tar.gz
             cargo_flags: "--no-default-features --features ort-dynamic,vector-search"
           - target: aarch64-apple-darwin
-            os: macos-14
+            os: macos-latest
             archive: tar.gz
             cargo_flags: ""