diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6ac51cc42..9f14b05bf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -77,7 +77,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-latest-xlarge]
+        os: [ubuntu-22.04,ubuntu-24.04,windows-2022,windows-2025,macos-14-xlarge,macos-15-xlarge]
         tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
     runs-on: ${{ matrix.os }}
 
diff --git a/package.json b/package.json
index 15fbe1c26..5125ea0d8 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "test": "npm run ava -- src/",
     "test-debug": "npm run test -- --timeout=20m",
     "transpile": "tsc --build --verbose tsconfig.json",
-    "update-pr-checks": "pr-checks/sync.sh"
+    "update-pr-checks": "./pr-checks/sync.sh"
   },
   "license": "MIT",
   "workspaces": [
diff --git a/pr-checks/sync.ts b/pr-checks/sync.ts
index cf04203c4..3faffc1d0 100755
--- a/pr-checks/sync.ts
+++ b/pr-checks/sync.ts
@@ -43,7 +43,7 @@ interface Specification extends JobSpecification {
   inputs?: Record<string, WorkflowInput>;
   /** CodeQL bundle versions to test against. Defaults to `DEFAULT_TEST_VERSIONS`. */
   versions?: string[];
-  /** Operating system prefixes used to select runner images (e.g. `["ubuntu", "macos"]`). */
+  /** Operating system prefixes, either as strings or with explicit runner image labels. */
   operatingSystems?: OperatingSystem[];
   /** Per-OS version overrides. If specified for an OS, only those versions are tested on that OS. */
   osCodeQlVersions?: Record<string, string[]>;