diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6ac57f038..54f23fa01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
     # Run every day at midnight UTC
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   boringssl_clone:
     # This step ensures that all builders have the same version of BoringSSL
@@ -19,7 +22,7 @@ jobs:
           echo Using BoringSSL commit: $(cd "${{ runner.temp }}/boringssl"; git rev-parse HEAD)
 
       - name: Archive BoringSSL source
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: boringssl-source
           path: ${{ runner.temp }}/boringssl
@@ -34,9 +37,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get git-clang-format
         # Uses the most recent clang-format on Ubuntu.
@@ -59,16 +63,60 @@ jobs:
         include:
           - platform: ubuntu-22.04
             tools_url: https://dl.google.com/android/repository/commandlinetools-linux-14742923_latest.zip
+            # Build the native libraries in an Ubuntu 20.04 container, which
+            # has glibc 2.31, so that the glibc 2.35 on the Ubuntu 22.04 runner
+            # doesn't become the floor for the libraries that are shipped. When built with Ubuntu
+            # 20.04, the libraries end up requiring glibc 2.14 (x86_64) and glibc 2.17 (aarch64).
+            container: ubuntu:20.04
           - platform: macos-latest
             tools_url: https://dl.google.com/android/repository/commandlinetools-mac-14742923_latest.zip
           - platform: windows-latest
             tools_url: https://dl.google.com/android/repository/commandlinetools-win-14742923_latest.zip
 
     runs-on: ${{ matrix.platform }}
+    container: ${{ matrix.container }}
 
     steps:
+      - name: Bootstrap build container
+        # The image is bare, so install what the later steps expect. Its CMake
+        # 3.16 and Clang 10 are both too old to build BoringSSL, so take CMake
+        # from Kitware and Clang from apt.llvm.org. Neither affects the glibc
+        # floor, which is set by the container's glibc.
+        if: matrix.container == 'ubuntu:20.04'
+        timeout-minutes: 15
+        run: |
+          set -eu
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get -qq update
+          apt-get -qq install -y --no-install-recommends \
+            build-essential \
+            ca-certificates \
+            curl \
+            g++-aarch64-linux-gnu \
+            git \
+            ninja-build \
+            openjdk-11-jdk-headless \
+            unzip
+
+          cmake_dir="cmake-$CMAKE_VERSION-linux-x86_64"
+          curl -sSL "https://github.com/Kitware/CMake/releases/download/v$CMAKE_VERSION/$cmake_dir.tar.gz" \
+            | tar xz -C /opt
+          ln -sf "/opt/$cmake_dir/bin/cmake" /usr/local/bin/cmake
+
+          curl -sSL https://apt.llvm.org/llvm-snapshot.gpg.key \
+            -o /etc/apt/trusted.gpg.d/llvm.asc
+          echo "deb http://apt.llvm.org/focal/ llvm-toolchain-focal-$LLVM_VERSION main" \
+            > /etc/apt/sources.list.d/llvm.list
+          apt-get -qq update
+          apt-get -qq install -y --no-install-recommends "clang-$LLVM_VERSION"
+          ln -sf "/usr/bin/clang-$LLVM_VERSION" /usr/local/bin/clang
+          ln -sf "/usr/bin/clang++-$LLVM_VERSION" /usr/local/bin/clang++
+        env:
+          CMAKE_VERSION: 3.31.6
+          LLVM_VERSION: 19
+
       - name: Set up JDK 17 for toolchains
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'temurin'
           java-version: 17
@@ -82,7 +130,9 @@ jobs:
           echo "SDKMANAGER=${{ runner.temp }}/android-sdk/cmdline-tools/bin/sdkmanager" >> $GITHUB_ENV
           echo "M2_REPO=${{ runner.temp }}/m2" >> $GITHUB_ENV
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Linux environment
         if: runner.os == 'Linux'
@@ -90,12 +140,16 @@ jobs:
           echo "CC=clang" >> $GITHUB_ENV
           echo "CXX=clang++" >> $GITHUB_ENV
 
-          sudo add-apt-repository ppa:openjdk-r/ppa
-          sudo apt-get -qq update
-          sudo apt-get -qq install -y --no-install-recommends \
-            g++-aarch64-linux-gnu \
-            ninja-build \
-            openjdk-17-jre-headless
+          # The Ubuntu 20.04 container already installed these in its bootstrap
+          # step above. Anything else building on Linux still needs them.
+          if [ "${{ matrix.container }}" != "ubuntu:20.04" ]; then
+            sudo add-apt-repository ppa:openjdk-r/ppa
+            sudo apt-get -qq update
+            sudo apt-get -qq install -y --no-install-recommends \
+              g++-aarch64-linux-gnu \
+              ninja-build \
+              openjdk-17-jre-headless
+          fi
 
       - name: Setup macOS environment
         if: runner.os == 'macOS'
@@ -110,7 +164,7 @@ jobs:
           choco install ninja -y
 
       - name: Fetch BoringSSL source
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: boringssl-source
           path: ${{ runner.temp }}/boringssl
@@ -130,28 +184,30 @@ jobs:
           mkdir -p "$BORINGSSL_HOME/build.x86"
           pushd "$BORINGSSL_HOME/build.x86"
           cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=x86_64 -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
           mkdir -p "$BORINGSSL_HOME/build.arm"
           pushd "$BORINGSSL_HOME/build.arm"
           cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_OSX_ARCHITECTURES=arm64 -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
       - name: Build BoringSSL 64-bit Linux
         # Please keep this in sync with other "Build BoringSSL 64-bit Linux"
         if: runner.os == 'Linux'
+        shell: bash # Required for pushd/popd
         run: |
           mkdir -p "$BORINGSSL_HOME/build64"
           pushd "$BORINGSSL_HOME/build64"
           cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
       - name: Build BoringSSL AArch64 Linux
         # Please keep this in sync with other "Build BoringSSL AArch64 Linux"
         if: runner.os == 'Linux'
+        shell: bash # Required for pushd/popd
         run: |
           mkdir -p "$BORINGSSL_HOME/build.arm"
           pushd "$BORINGSSL_HOME/build.arm"
@@ -162,12 +218,12 @@ jobs:
                 -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \
                 -DCMAKE_BUILD_TYPE=Release \
                 -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
       - name: Set up MSVC paths on Windows
         if: runner.os == 'Windows'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1.13.0
         with:
             arch: x64
 
@@ -178,14 +234,17 @@ jobs:
           mkdir build64
           pushd build64
           cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -DCMAKE_MSVC_RUNTIME_LIBRARY=MultiThreaded -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
       - name: Setup Android environment
         shell: bash
         if: runner.os == 'Linux'
         run: |
-          cd "${{ runner.temp }}"
+          # $RUNNER_TEMP, not ${{ runner.temp }}: the runner rewrites host paths
+          # to container paths in the environment it injects, but not in the
+          # script text it expands beforehand.
+          cd "$RUNNER_TEMP"
           curl -L "${{ matrix.tools_url }}" -o android-tools.zip
           mkdir -p "$ANDROID_HOME"
           unzip -q android-tools.zip -d "$ANDROID_HOME"
@@ -212,7 +271,7 @@ jobs:
         run: ./gradlew publishToMavenLocal -Dmaven.repo.local="$M2_REPO"
 
       - name: Upload Maven respository
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: m2repo-${{ runner.os }}
           path: ${{ runner.temp }}/m2
@@ -224,7 +283,7 @@ jobs:
 
       - name: Upload test JAR with dependencies
         if: runner.os == 'Linux'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: testjar
           path: openjdk/build/libs/conscrypt-openjdk-*-tests.jar
@@ -250,7 +309,7 @@ jobs:
 
     steps:
       - name: Set up JDK 17 for toolchains
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: 'temurin'
           java-version: 17
@@ -260,10 +319,12 @@ jobs:
         run: |
           echo "ANDROID_HOME=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
           echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Fetch BoringSSL source
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: boringssl-source
           path: ${{ runner.temp }}/boringssl
@@ -277,7 +338,7 @@ jobs:
         run: |
           yes | $ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager --licenses || true
       - name: Run instrumentation tests on Emulator
-        uses: reactivecircus/android-emulator-runner@v2
+        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
         with:
           api-level: ${{ matrix.api-level }}
           arch: ${{ matrix.arch }}
@@ -292,7 +353,9 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Linux environment
         run: |
@@ -313,7 +376,7 @@ jobs:
           echo "BORINGSSL_HOME=${{ runner.temp }}/boringssl" >> $GITHUB_ENV
 
       - name: Fetch BoringSSL source
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: boringssl-source
           path: ${{ runner.temp }}/boringssl
@@ -330,7 +393,7 @@ jobs:
           mkdir -p "$BORINGSSL_HOME/build64"
           pushd "$BORINGSSL_HOME/build64"
           cmake -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE -DCMAKE_BUILD_TYPE=Release -GNinja ..
-          ninja
+          ninja crypto ssl
           popd
 
       - name: Build BoringSSL AArch64 Linux
@@ -345,7 +408,7 @@ jobs:
                 -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \
                 -DCMAKE_BUILD_TYPE=Release \
                 -GNinja ..
-          ninja
+          ninja crypto ssl
 
       # TODO(prb) remove build dependency above and go back to this.
       # - name: Make fake BoringSSL directories
@@ -359,19 +422,19 @@ jobs:
       #     mkdir -p "${{ runner.temp }}/boringssl/include"
 
       - name: Download Maven repository for Linux
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: m2repo-Linux
           path: ${{ runner.temp }}/m2
 
       - name: Download Maven repository for MacOS
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: m2repo-macOS
           path: ${{ runner.temp }}/m2
 
       - name: Download Maven repository for Windows
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: m2repo-Windows
           path: ${{ runner.temp }}/m2
@@ -387,7 +450,7 @@ jobs:
           ./gradlew :conscrypt-openjdk-uber:publishToMavenLocal -Dorg.conscrypt.openjdk.buildUberJar=true -Dmaven.repo.local="$M2_REPO"
 
       - name: Upload Maven respository
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: m2repo-uber
           path: ${{ runner.temp }}/m2
@@ -428,26 +491,26 @@ jobs:
     steps:
       - name: Set up Java
         if: ${{ matrix.java != 'EA' }}
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: ${{ matrix.dist }}
           java-version: ${{ matrix.java }}
 
       - name: 'Set up JDK ${{ matrix.java }} from jdk.java.net'
         if: ${{ matrix.java == 'EA' }}
-        uses: oracle-actions/setup-java@v1
+        uses: oracle-actions/setup-java@fff43251af9936a0e6a4d5d0946e14f1680e9b6b # v1.5.0
         with:
           website: jdk.java.net
           release: ${{ matrix.java }}
 
       - name: Download UberJAR
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: m2repo-uber
           path: m2
 
       - name: Download Test JAR with Dependencies
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: testjar
           path: testjar
@@ -489,7 +552,7 @@ jobs:
 
       - name: Archive test results
         if: ${{ always() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: test-results-${{ matrix.platform }}-${{ matrix.java }}-${{ matrix.dist }}
           path: results
diff --git a/common/src/main/java/org/conscrypt/BufferAllocator.java b/common/src/main/java/org/conscrypt/BufferAllocator.java
index 55fb685e6..7b1f0df39 100644
--- a/common/src/main/java/org/conscrypt/BufferAllocator.java
+++ b/common/src/main/java/org/conscrypt/BufferAllocator.java
@@ -50,5 +50,7 @@ public static BufferAllocator unpooled() {
     /**
      * Allocates a heap buffer with the given capacity.
      */
-    public abstract AllocatedBuffer allocateHeapBuffer(int capacity);
+    public AllocatedBuffer allocateHeapBuffer(int capacity) {
+        throw new UnsupportedOperationException("Heap buffer allocation is not supported");
+    }
 }
diff --git a/openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java b/openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java
index ec6306b78..dfb77485d 100644
--- a/openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java
+++ b/openjdk/src/test/java/org/conscrypt/NativeCryptoTest.java
@@ -404,17 +404,13 @@ public void setGroupsList_validGroups_works() throws Exception {
         NativeCrypto.SSL_set1_groups(s, null, new int[] {NativeConstants.NID_secp384r1});
         NativeCrypto.SSL_set1_groups(s, null, new int[] {NativeConstants.NID_secp521r1});
         NativeCrypto.SSL_set1_groups(s, null, new int[] {NativeConstants.NID_X25519MLKEM768});
-        NativeCrypto.SSL_set1_groups(s, null,
-                                     new int[] {NativeConstants.NID_X25519Kyber768Draft00});
         NativeCrypto.SSL_set1_groups(s, null, new int[] {NativeConstants.NID_ML_KEM_1024});
 
         NativeCrypto.SSL_set1_groups(
                 s, null,
                 new int[] {NativeConstants.NID_X25519, NativeConstants.NID_X9_62_prime256v1,
                            NativeConstants.NID_secp384r1, NativeConstants.NID_secp521r1,
-                           NativeConstants.NID_X25519MLKEM768,
-                           NativeConstants.NID_X25519Kyber768Draft00,
-                           NativeConstants.NID_ML_KEM_1024});
+                           NativeConstants.NID_X25519MLKEM768, NativeConstants.NID_ML_KEM_1024});
 
         NativeCrypto.SSL_free(s, null);
         NativeCrypto.SSL_CTX_free(c, null);