diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a64cd45..1f154b8 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -22,10 +22,19 @@ jobs:
     env:
       PYTHON: ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # fetch all history for setuptools_scm to be able to read tags
 
+      - name: Fix Debian Buster repositories (EOL)
+        if: matrix.image-variant == '-buster'
+        run: |
+          # Debian Buster reached EOL, switch to archive.debian.org
+          # Remove security repo entirely (not available in archive) and use main archive
+          sed -i 's|deb.debian.org|archive.debian.org|g' /etc/apt/sources.list
+          sed -i '/security.debian.org/d' /etc/apt/sources.list
+          sed -i '/buster-updates/d' /etc/apt/sources.list
+
       - name: Install python dependencies
         run: |
           apt-get update
diff --git a/.github/workflows/cla.yaml b/.github/workflows/cla.yaml
index fa180c6..c4f291e 100644
--- a/.github/workflows/cla.yaml
+++ b/.github/workflows/cla.yaml
@@ -23,3 +23,4 @@ jobs:
           path-to-signatures: signatures.json
           remote-organization-name: secondlife
           remote-repository-name: cla-signatures
+          allowlist: dependabot[bot]