diff --git a/.github/workflows/ci_examples_java.yml b/.github/workflows/ci_examples_java.yml
index 08e1b30b4f..d33c4fc934 100644
--- a/.github/workflows/ci_examples_java.yml
+++ b/.github/workflows/ci_examples_java.yml
@@ -29,7 +29,7 @@ jobs:
       max-parallel: 1
       matrix:
         java-version: [8, 11, 16, 17]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/ci_examples_net.yml b/.github/workflows/ci_examples_net.yml
index f9f4582878..4e50a975b2 100644
--- a/.github/workflows/ci_examples_net.yml
+++ b/.github/workflows/ci_examples_net.yml
@@ -27,7 +27,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         dotnet-version: ["6.0.x"]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/ci_test_java.yml b/.github/workflows/ci_test_java.yml
index e64e268739..66e0bfe179 100644
--- a/.github/workflows/ci_test_java.yml
+++ b/.github/workflows/ci_test_java.yml
@@ -29,7 +29,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         java-version: [8, 11, 16, 17]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/ci_test_net.yml b/.github/workflows/ci_test_net.yml
index 6656e3060b..9a9767262f 100644
--- a/.github/workflows/ci_test_net.yml
+++ b/.github/workflows/ci_test_net.yml
@@ -25,7 +25,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         dotnet-version: ["6.0.x"]
-        os: [macos-12, ubuntu-latest, windows-latest]
+        os: [macos-13, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/ci_todos.yml b/.github/workflows/ci_todos.yml
index 9c58879e21..12efe41d9c 100644
--- a/.github/workflows/ci_todos.yml
+++ b/.github/workflows/ci_todos.yml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   findTodos:
-    runs-on: macos-12
+    runs-on: macos-13
     steps:
       - uses: actions/checkout@v3
 
diff --git a/.github/workflows/dafny_interop_examples_java.yml b/.github/workflows/dafny_interop_examples_java.yml
index 5e6b02cca3..3c1d7a9441 100644
--- a/.github/workflows/dafny_interop_examples_java.yml
+++ b/.github/workflows/dafny_interop_examples_java.yml
@@ -28,7 +28,7 @@ jobs:
       max-parallel: 1
       matrix:
         java-version: [8, 11, 16, 17]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/dafny_interop_examples_net.yml b/.github/workflows/dafny_interop_examples_net.yml
index 245cada7e5..dad02aac52 100644
--- a/.github/workflows/dafny_interop_examples_net.yml
+++ b/.github/workflows/dafny_interop_examples_net.yml
@@ -24,7 +24,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         dotnet-version: ["6.0.x"]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/dafny_interop_java.yml b/.github/workflows/dafny_interop_java.yml
index 90fa6322e6..a1b049a121 100644
--- a/.github/workflows/dafny_interop_java.yml
+++ b/.github/workflows/dafny_interop_java.yml
@@ -28,7 +28,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         java-version: [8, 11, 16, 17]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/dafny_interop_test_net.yml b/.github/workflows/dafny_interop_test_net.yml
index 07f2ede8a7..b87519059a 100644
--- a/.github/workflows/dafny_interop_test_net.yml
+++ b/.github/workflows/dafny_interop_test_net.yml
@@ -24,7 +24,7 @@ jobs:
       matrix:
         library: [DynamoDbEncryption]
         dotnet-version: ["6.0.x"]
-        os: [macos-12, ubuntu-latest, windows-latest]
+        os: [macos-13, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     permissions:
       id-token: write
diff --git a/.github/workflows/library_dafny_verification.yml b/.github/workflows/library_dafny_verification.yml
index b1803683de..21f25c39f6 100644
--- a/.github/workflows/library_dafny_verification.yml
+++ b/.github/workflows/library_dafny_verification.yml
@@ -39,7 +39,7 @@ jobs:
             DynamoDbItemEncryptor,
             StructuredEncryption,
           ]
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -72,7 +72,7 @@ jobs:
           sed "s/mplDependencyJavaVersion=.*/mplDependencyJavaVersion=${{inputs.mpl-version}}/g" project.properties > project.properties2; mv project.properties2 project.properties
 
       # dafny-reportgenerator requires next6
-      # but only 7.0 is installed on macos-12-large
+      # but only 7.0 is installed on macos-13-large
       - name: Setup .NET Core SDK '6.0.x'
         uses: actions/setup-dotnet@v4
         with:
diff --git a/.github/workflows/library_format.yml b/.github/workflows/library_format.yml
index 1faa244b3e..fa37e073ac 100644
--- a/.github/workflows/library_format.yml
+++ b/.github/workflows/library_format.yml
@@ -19,7 +19,7 @@ jobs:
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     strategy:
       matrix:
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
diff --git a/.github/workflows/sem_ver.yml b/.github/workflows/sem_ver.yml
index e1c5ec9158..93154bb364 100644
--- a/.github/workflows/sem_ver.yml
+++ b/.github/workflows/sem_ver.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   semantic-release:
-    runs-on: macos-12
+    runs-on: macos-13
     permissions:
       id-token: write
       contents: read
diff --git a/.github/workflows/semantic_release.yml b/.github/workflows/semantic_release.yml
index 1179ae5605..9110e579e4 100644
--- a/.github/workflows/semantic_release.yml
+++ b/.github/workflows/semantic_release.yml
@@ -15,7 +15,7 @@ jobs:
     # privileged operation, so we must make sure this list of users is a subset of the users labeled as maintainers of
     # https://github.com/orgs/aws/teams/aws-crypto-tools
     if: contains('["seebees","texastony","ShubhamChaturvedi7","lucasmcdonald3","josecorella","imabhichow","rishav-karanjit","antonf-amzn","kessplas","ajewellamz","RitvikKapila"]', github.actor)
-    runs-on: macos-12
+    runs-on: macos-13
     permissions:
       id-token: write
       contents: write
diff --git a/.github/workflows/test_vector_verification.yml b/.github/workflows/test_vector_verification.yml
index aa4a488dc0..6d0fad6118 100644
--- a/.github/workflows/test_vector_verification.yml
+++ b/.github/workflows/test_vector_verification.yml
@@ -29,7 +29,7 @@ jobs:
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     strategy:
       matrix:
-        os: [macos-12]
+        os: [macos-13]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -62,7 +62,7 @@ jobs:
           sed "s/mplDependencyJavaVersion=.*/mplDependencyJavaVersion=${{inputs.mpl-version}}/g" project.properties > project.properties2; mv project.properties2 project.properties
 
       # dafny-reportgenerator requires next6
-      # but only 7.0 is installed on macos-12-large
+      # but only 7.0 is installed on macos-13-large
       - name: Setup .NET Core SDK '6.0.x'
         uses: actions/setup-dotnet@v4
         with: