diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b517bae74..bd0612321 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -161,7 +161,7 @@ jobs:
 
   # A native macOS job, not a cross-compile from the linux `build` job above.
   # relayflowd's release build has no cross-compile setup (no osxcross, no
-  # macOS SDK on the linux runner), and macos-14 runners are Apple Silicon, so
+  # macOS SDK on the linux runner), and macos-15 runners are Apple Silicon, so
   # `cargo build --release` already targets aarch64-apple-darwin natively —
   # the same reason no `--target` flag is needed below.
   #
@@ -174,7 +174,7 @@ jobs:
   # for no reason; they can run in parallel instead.
   build-darwin-arm64:
     name: Build & pack darwin-arm64 runtime
-    runs-on: macos-14
+    runs-on: macos-15
     timeout-minutes: 30
     steps:
       - name: Validate release mode
@@ -286,7 +286,7 @@ jobs:
       # runtime-darwin-arm64's own execution smoke does not re-run here — this
       # runner is linux, so pack-release.mjs asserts its shape only, per the
       # foreign-host skip described where that check lives. It already ran for
-      # real on the macos-14 runner that built it.
+      # real on the macos-15 runner that built it.
       - name: Pack and assert all release tarballs
         run: |
           node scripts/pack-release.mjs surface