diff --git a/.github/workflows/build-matrix.json b/.github/workflows/build-matrix.json
index 71c87f1833..506e59b0ac 100644
--- a/.github/workflows/build-matrix.json
+++ b/.github/workflows/build-matrix.json
@@ -9,12 +9,21 @@
       "generator": "Ninja"
     },
     {
-      "os": "macos-latest",
+      "comment": "Explicit macOS version 13 is required for explicit x64 CPU.",
+      "os": "macos-13",
       "os_name": "osx",
       "target_arch": "x64",
       "exe_ext": "",
       "generator": "Ninja"
     },
+    {
+      "comment": "Explicit macOS version 14 is required for explicit arm64 CPU.",
+      "os": "macos-14",
+      "os_name": "osx",
+      "target_arch": "arm64",
+      "exe_ext": "",
+      "generator": "Ninja"
+    },
     {
       "os": "windows-latest",
       "os_name": "win",
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6f0c159e0f..13c7b145cc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -127,6 +127,28 @@ jobs:
         run: |
           brew install ninja
 
+      - name: Check Mac CPU architecture
+        if: runner.os == 'macOS'
+        # In case we get confused about GitHub's mac VM image labels,
+        # explicitly check that the CPU type matches our expectations.
+        run: |
+          if [[ "${{matrix.target_arch}}" == "arm64" ]]; then
+            CORRECT_LABEL="arm64"
+          else
+            CORRECT_LABEL="x86_64"
+          fi
+
+          LABEL=$(uname -m)
+          echo "Hardware label: \"$LABEL\""
+
+          if [[ "$LABEL" != "$CORRECT_LABEL" ]]; then
+            echo "Wrong hardware label \"$LABEL\", expecting \"$CORRECT_LABEL\"."
+            echo "Full uname string: $(uname -a)"
+            echo "Full sysctl CPU info:"
+            sysctl machdep.cpu
+            exit 1
+          fi
+
       - name: Generate build files
         run: |
           mkdir -p build/