diff --git a/.github/workflows/apps-config.yml b/.github/workflows/apps-config.yml
index 4ab793ce16..941c8f2f7f 100644
--- a/.github/workflows/apps-config.yml
+++ b/.github/workflows/apps-config.yml
@@ -9,13 +9,14 @@ on:
       # NOTE: Update badges and table in README when changing runner OS versions
       macos:
         description: macos OS value
-        value: "macos-12"
+        # https://github.com/rstudio/shiny-workflows/blob/fdfacec40c723210c92a287dcb67cdf7f5d621ef/.github/workflows/R-CMD-check.yaml#L23
+        value: "macos-latest"
       windows:
         description: windows OS value
-        value: "windows-2022"
+        value: "windows-latest"
       ubuntu:
         description: ubuntu OS value
-        value: "ubuntu-20.04"
+        value: "ubuntu-latest"
       cache-version:
         description: cache-version to be used when pulling library cache
         value: "5"
diff --git a/.github/workflows/apps-test-matrix.yml b/.github/workflows/apps-test-matrix.yml
index 2353ade377..b3bec85ce0 100644
--- a/.github/workflows/apps-test-matrix.yml
+++ b/.github/workflows/apps-test-matrix.yml
@@ -58,7 +58,9 @@ jobs:
     uses: ./.github/workflows/apps-test-os.yml
     with:
       r-version: ${{ needs.config.outputs.oldrel4 }}
-      os: ${{ needs.config.outputs.macos }}
+      os: macos-13
+      # TODO-future: Use config below when the oldrel4 r-version is >= 4.1
+      # os: ${{ needs.config.outputs.macos }}
       cache-version: ${{ needs.config.outputs.cache-version }}
 
   ubuntu-release:
diff --git a/.github/workflows/apps-test-os.yml b/.github/workflows/apps-test-os.yml
index da5e897e30..ccb7c16062 100644
--- a/.github/workflows/apps-test-os.yml
+++ b/.github/workflows/apps-test-os.yml
@@ -47,43 +47,6 @@ jobs:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - name: Short R version, SHA, and OS
-        id: short
-        shell: bash
-        run: |
-          # keep only the major.minor values
-          RVERSION=`echo '${{ inputs.r-version }}' | sed 's/\([0-9]\.[0-9]\).*/\1/'`
-          echo "r-version: $RVERSION"
-          echo "r-version=$RVERSION" >> $GITHUB_OUTPUT
-
-          SHA="${{github.event.pull_request.head.sha}}${{ github.sha }}"
-          if [[ -z "$SHA" ]]; then
-            SHA="${{ github.sha }}"
-          fi
-          SHORT_SHA="${SHA:0:7}"
-          echo "sha: $SHORT_SHA"
-          echo "sha=$SHORT_SHA" >> $GITHUB_OUTPUT
-
-          OS=`Rscript -e 'cat(sessionInfo()$running, "\n", sep = "")'`
-          echo "os-version=$OS" >> $GITHUB_OUTPUT
-
-      # The `github.sha` value is the commit sha as if the PR was merged. :-(
-      # https://help.github.com/en/actions/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-event-pull_request
-      # Checking for the pull request sha and then pasting it to the possibly 'merged' sha.  If main branch, only the `.sha` exists. If a PR, the PR sha exists.
-      #  Either way, take the first 7 characters.
-      # Found `github.event.pull_request.head.sha` example here: https://github.com/actions/checkout/commit/cab31617d857bf9e70dc35fd9e4dafe350794082#diff-04c6e90faac2675aa89e2176d2eec7d8R92
-      # The webhook payload example (equivalent to `github.event.pull_request`) shows the keys `head > sha` : https://developer.github.com/v3/activity/events/types/#pullrequestevent
-      - name: Create failure branch name
-        id: failed_branch
-        shell: Rscript {0}
-        run: |
-          cat("name=", '${{ steps.short.outputs.sha }}', '${{ inputs.extra-key }}', '-', format(Sys.time(), '%Y_%m_%d_%H_%M'), "\n", file = Sys.getenv("GITHUB_OUTPUT"), sep = "", append = TRUE)
-      - name: Create GHA branch name (i.e., test run identifier)
-        id: gha_branch
-        shell: Rscript {0}
-        run: |
-          cat("name=gha-", '${{ steps.failed_branch.outputs.name }}', '-', '${{ steps.short.outputs.r-version }}', '-', '${{ runner.os }}', "\n", file = Sys.getenv("GITHUB_OUTPUT"), sep = "", append = TRUE)
-
       - name: Windows git setup
         if: runner.os == 'Windows'
         run: git config --global core.autocrlf false
@@ -131,6 +94,40 @@ jobs:
           pandoc-version: ${{ inputs.pandoc-version }}
           extra-packages: ${{ inputs.extra-packages }}
 
+      - name: Short R version, SHA, and OS
+        id: short
+        shell: bash
+        run: |
+          # keep only the major.minor values
+          RVERSION=`echo '${{ inputs.r-version }}' | sed 's/\([0-9]\.[0-9]\).*/\1/'`
+          echo "r-version: $RVERSION"
+          echo "r-version=$RVERSION" >> $GITHUB_OUTPUT
+
+          SHA="${{github.event.pull_request.head.sha}}${{ github.sha }}"
+          if [[ -z "$SHA" ]]; then
+            SHA="${{ github.sha }}"
+          fi
+          SHORT_SHA="${SHA:0:7}"
+          echo "sha: $SHORT_SHA"
+          echo "sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+
+      # The `github.sha` value is the commit sha as if the PR was merged. :-(
+      # https://help.github.com/en/actions/automating-your-workflow-with-github-actions/events-that-trigger-workflows#pull-request-event-pull_request
+      # Checking for the pull request sha and then pasting it to the possibly 'merged' sha.  If main branch, only the `.sha` exists. If a PR, the PR sha exists.
+      #  Either way, take the first 7 characters.
+      # Found `github.event.pull_request.head.sha` example here: https://github.com/actions/checkout/commit/cab31617d857bf9e70dc35fd9e4dafe350794082#diff-04c6e90faac2675aa89e2176d2eec7d8R92
+      # The webhook payload example (equivalent to `github.event.pull_request`) shows the keys `head > sha` : https://developer.github.com/v3/activity/events/types/#pullrequestevent
+      - name: Create failure branch name
+        id: failed_branch
+        shell: Rscript {0}
+        run: |
+          cat("name=", '${{ steps.short.outputs.sha }}', '${{ inputs.extra-key }}', '-', format(Sys.time(), '%Y_%m_%d_%H_%M'), "\n", file = Sys.getenv("GITHUB_OUTPUT"), sep = "", append = TRUE)
+      - name: Create GHA branch name (i.e., test run identifier)
+        id: gha_branch
+        shell: Rscript {0}
+        run: |
+          cat("name=gha-", '${{ steps.failed_branch.outputs.name }}', '-', '${{ steps.short.outputs.r-version }}', '-', '${{ runner.os }}', "\n", file = Sys.getenv("GITHUB_OUTPUT"), sep = "", append = TRUE)
+
       # Install packages as necessary!
       - name: Run tests
         timeout-minutes: 180 # 3 hrs
@@ -147,6 +144,7 @@ jobs:
           if (is_pull_request) {
             # reduce apps to only changed apps
             files_changed <- jsonlite::parse_json('${{ steps.files_changed.outputs.added_modified }}', simplifyVector = TRUE)
+            has_altered_github <- any(unlist(lapply(strsplit(files_changed, "/"), function(folder_components) { folder_components[[1]] == ".github" })))
             changed_app_folders <-
               Filter(strsplit(files_changed, "/"), f = function(item) {
                 length(item) >= 3 &&
@@ -154,7 +152,9 @@ jobs:
                 dir.exists(file.path(item[[1]], item[[2]], item[[3]]))
               })
             unique_changed_apps <- unique(unlist(lapply(changed_app_folders, `[[`, 3)))
-            if (length(unique_changed_apps) > 10) {
+            if (has_altered_github) {
+              message("Altered `.github` folder. Testing all apps!")
+            } else if (length(unique_changed_apps) > 10) {
               message("More than ten apps were altered. Testing all apps!")
             } else if (length(changed_app_folders) > 250) {
               message("More than 250 app files were altered. Testing all apps!")
diff --git a/.github/workflows/apps-test-precheck.yml b/.github/workflows/apps-test-precheck.yml
index f47e318bc5..367e75535c 100644
--- a/.github/workflows/apps-test-precheck.yml
+++ b/.github/workflows/apps-test-precheck.yml
@@ -35,6 +35,10 @@ jobs:
           for FIL in ${FILES_CHANGED[@]}; do
             echo "Inspecting file: '$FIL'"
             # check if path is in apps
+            if [[ "$FIL" =~ ^".github" ]]; then
+              echo '.github folder was altered. Returning early'
+              exit 0
+            fi
             if [[ "$FIL" =~ ^"inst/apps" ]]; then
               SUBFIL=$(echo "$FIL" | cut -d/ -f 1-2)
               echo "first two folders of file: '$SUBFIL'"