diff --git a/.github/workflows/patch-test.yaml b/.github/workflows/patch-test.yaml
index a5b7abdb1..1261ab62d 100644
--- a/.github/workflows/patch-test.yaml
+++ b/.github/workflows/patch-test.yaml
@@ -13,7 +13,7 @@ env:
 jobs:
   find-ghc-version:
     name: Find GHC versions for which a bindist is provided
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     outputs:
       ghc-matrix: ${{ steps.set-ghc-versions.outputs.ghc-matrix }}
     steps:
@@ -30,7 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-13, windows-latest]
+        os: [ubuntu-22.04, macos-13, windows-latest]
         ghc-version: ${{ fromJSON(needs.find-ghc-version.outputs.ghc-matrix) }}
     runs-on: ${{ matrix.os }}
     steps:
@@ -39,7 +39,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install --no-install-recommends -yy libtinfo5
           sudo apt-get clean
-        if: ${{ matrix.os == 'ubuntu-latest' }}
+        if: ${{ matrix.os == 'ubuntu-22.04' }}
       - uses: actions/checkout@v4
       - name: Mount Bazel cache
         uses: actions/cache@v4
diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml
index d308ddffa..7619bb0ff 100644
--- a/.github/workflows/prepare-release.yaml
+++ b/.github/workflows/prepare-release.yaml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   release:
     name: Prepare Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Check version
         run: |
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index d48991e1e..a0dc2c2e3 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -8,7 +8,7 @@ on:
 jobs:
   webpage:
     name: Update webpage
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/.github/workflows/update-ghc.yaml b/.github/workflows/update-ghc.yaml
index f050e192b..31bbcc29f 100644
--- a/.github/workflows/update-ghc.yaml
+++ b/.github/workflows/update-ghc.yaml
@@ -7,7 +7,7 @@ on:
 jobs:
   update_ghc:
     name: GHC ${{ matrix.ghc }} Update
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index b6eb9942b..e2157c586 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   lint:
     name: Format & Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: tweag/configure-bazel-remote-cache-auth@v0
@@ -43,7 +43,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-13]
+        os: [ubuntu-22.04, macos-13]
         module: [rules_haskell, rules_haskell_nix, rules_haskell_tests]
         bzlmod: [true, false]
         ghc:
@@ -139,7 +139,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-13, windows-latest]
+        os: [ubuntu-22.04, macos-13, windows-latest]
         module: [rules_haskell, rules_haskell_tests]
         bzlmod: [true, false]
         ghc:
@@ -253,7 +253,7 @@ jobs:
           path: logs
 
   all_ci_tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
       - lint
       - test-nixpkgs
diff --git a/WORKSPACE b/WORKSPACE
index ff43dcf5a..d20514b9e 100755
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -142,9 +142,9 @@ buildifier_dependencies()
 
 http_archive(
     name = "cgrindel_bazel_starlib",
-    sha256 = "43e375213dabe0c3928e65412ea7ec16850db93285c8c6f8b0eaa41cacd0f882",
+    sha256 = "f21010cb8954605a3b72348d02259cbc8d139984e5049bb3a1bb1d1ae31a4e40",
     urls = [
-        "https://github.com/cgrindel/bazel-starlib/releases/download/v0.21.0/bazel-starlib.v0.21.0.tar.gz",
+        "https://github.com/cgrindel/bazel-starlib/releases/download/v0.23.0/bazel-starlib.v0.23.0.tar.gz",
     ],
 )
 
diff --git a/examples/primitive/.github/workflows/ci.yml b/examples/primitive/.github/workflows/ci.yml
index 378945fab..f45c7b66c 100644
--- a/examples/primitive/.github/workflows/ci.yml
+++ b/examples/primitive/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest]
+        os: [ubuntu-22.04]
         ghc: ['8.0', '8.2', '8.4', '8.6', '8.8', '8.10', '9.0', '9.2', '9.4', '9.6']
         include:
         - os: windows-latest
@@ -23,7 +23,7 @@ jobs:
         - os: macOS-latest
           ghc: 'latest'
         ## Already covered by '9.4'
-        # - os: ubuntu-latest
+        # - os: ubuntu-22.04
         #   ghc: 'latest'
     steps:
     - uses: actions/checkout@v3
diff --git a/rules_haskell_tests/MODULE.bazel b/rules_haskell_tests/MODULE.bazel
index d60cb6783..740a81efb 100644
--- a/rules_haskell_tests/MODULE.bazel
+++ b/rules_haskell_tests/MODULE.bazel
@@ -93,7 +93,7 @@ bazel_dep(
     version = "0.27.0",
     dev_dependency = True,
 )
-bazel_dep(name = "cgrindel_bazel_starlib", version = "0.21.0")
+bazel_dep(name = "cgrindel_bazel_starlib", version = "0.23.0")
 bazel_dep(name = "rules_shell", version = "0.3.0")
 
 ghc_version = use_extension("@rules_haskell//extensions:ghc_version.bzl", "ghc_default_version")
diff --git a/rules_haskell_tests/WORKSPACE b/rules_haskell_tests/WORKSPACE
index 064ae2052..9841f16f3 100644
--- a/rules_haskell_tests/WORKSPACE
+++ b/rules_haskell_tests/WORKSPACE
@@ -70,9 +70,9 @@ http_archive(
 
 http_archive(
     name = "cgrindel_bazel_starlib",
-    sha256 = "43e375213dabe0c3928e65412ea7ec16850db93285c8c6f8b0eaa41cacd0f882",
+    sha256 = "f21010cb8954605a3b72348d02259cbc8d139984e5049bb3a1bb1d1ae31a4e40",
     urls = [
-        "https://github.com/cgrindel/bazel-starlib/releases/download/v0.21.0/bazel-starlib.v0.21.0.tar.gz",
+        "https://github.com/cgrindel/bazel-starlib/releases/download/v0.23.0/bazel-starlib.v0.23.0.tar.gz",
     ],
 )