diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4d1010a..c5b45ca 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,7 @@ jobs:
         - python: '2.7'
           cython: cython==0.28
         - python: '2.7'
+          os: ubuntu-20.04
         - python: '3.5'
           os: ubuntu-20.04
           cython: cython==0.28
@@ -27,11 +28,7 @@ jobs:
           os: ubuntu-22.04
         - python: '3.12-dev'
           os: ubuntu-22.04
-    runs-on: ${{matrix.os || 'ubuntu-latest'}}
-    container: ${{ ((matrix.python == '2.7') && 'python:2.7') || null }}
-    defaults:
-      run:
-        shell: bash
+    runs-on: ${{matrix.os}}
     steps:
     - uses: actions/checkout@v3
     - name: set up PATH
@@ -46,12 +43,19 @@ jobs:
     - name: set up APT
       if: matrix.python == '2.7'
       run: |
-        printf 'Apt::Install-Recommends "false";\n' | tee -a /etc/apt/apt.conf
-        apt-get update
+        printf 'Apt::Install-Recommends "false";\n' | sudo tee -a /etc/apt/apt.conf
+        sudo apt-get update
+    - name: set up Python 2.7 (with APT + get-pip)
+      if: matrix.python == '2.7'
+      run: |
+        sudo apt-get install -y python-is-python2
+        curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
+        sudo python get-pip.py
+        rm get-pip.py
     - name: upgrade TLS stack
       if: matrix.python == '2.7'
       run: |
-        apt-get install --only-upgrade -y ca-certificates libgnutls30
+        sudo apt-get install --only-upgrade -y ca-certificates libgnutls30
     - name: install setuptools (if distutils is missing)
       if: env.pythonLocation
       run: |