diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index f7b2bf49f..8cd7f93aa 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -6,7 +6,7 @@ name: OpenTimelineIO
 # for configuring which build will be a C++ coverage build / coverage report
 env:
   GH_COV_PY: "3.10"
-  GH_COV_OS: ubuntu-22.04
+  GH_COV_OS: ubuntu-latest
   GH_DEPENDABOT: dependabot
 
 on:
@@ -24,15 +24,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, windows-2022, macos-12]
+        os: [ubuntu-latest, windows-latest, macos-latest]
         # Unfortunately the CMake test target is OS dependent so we set it as
         # a variable here.
         include:
-        - os: ubuntu-22.04
+        - os: ubuntu-latest
           OTIO_TEST_TARGET: test
-        - os: windows-2022
+        - os: windows-latest
           OTIO_TEST_TARGET: RUN_TESTS
-        - os: macos-12
+        - os: macos-latest
           OTIO_TEST_TARGET: test
 
     env:
@@ -92,13 +92,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, windows-2022, macos-12]
+        os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ['3.7', '3.8', '3.9', '3.10', '3.11', '3.12']
         include:
-          - { os: ubuntu-22.04, shell: bash }
-          - { os: macos-12, shell: bash }
-          - { os: windows-2022, shell: pwsh }
-          - { os: windows-2022, shell: msys2, python-version: 'mingw64' }
+          - { os: ubuntu-latest, shell: bash }
+          - { os: macos-latest, shell: bash }
+          - { os: windows-latest, shell: pwsh }
+          - { os: windows-latest, shell: msys2, python-version: 'mingw64' }
 
     defaults:
       run:
@@ -163,7 +163,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, windows-2022, macos-12]
+        os: [ubuntu-latest, windows-latest, macos-latest]
         python-build: ['cp37*', 'cp38*', 'cp39*', 'cp310*', 'cp311*', 'cp312*']
     steps:
       - uses: actions/checkout@v3
@@ -185,7 +185,7 @@ jobs:
 
   package_sdist:
     needs: py_build_test
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
       with:
diff --git a/Makefile b/Makefile
index 6b1e8224a..eae9391df 100644
--- a/Makefile
+++ b/Makefile
@@ -259,7 +259,7 @@ update-contributors: check-github-token
 	@echo "Updating CONTRIBUTORS.md..."
 	@python maintainers/fetch_contributors.py \
 		--repo AcademySoftwareFoundation/OpenTimelineIO \
-		--token $(OTIO_RELEASE_GITHUB_TOKEN)
+		--token "${OTIO_RELEASE_GITHUB_TOKEN}"
 
 dev-python-install:
 	@python setup.py install
diff --git a/maintainers/freeze_ci_versions.py b/maintainers/freeze_ci_versions.py
index aa230a097..2be2c3a8e 100644
--- a/maintainers/freeze_ci_versions.py
+++ b/maintainers/freeze_ci_versions.py
@@ -49,24 +49,69 @@ def _parsed_args():
     return parser.parse_args()
 
 
-def main():
-    args = _parsed_args()
-
+def fetch_plat_map():
+    # HACK: pull the image version corresponding to -latest out of the
+    #       README.md for the github repo where they are stored
     request = urllib.request.Request(GITHUB_README_URL)
     response = urllib.request.urlopen(request).read().decode('utf-8')
 
-    # HACK: pull the image version corresponding to -latest out of the
-    #       README.md for the github repo where they are stored
+    def md_row_fields(md_row):
+        # Split on |, discard the empty entries from leading and trailing |
+        return [
+            col.strip() for col in md_row.split("|")[1:-1]
+        ]
+
+    # First, just strip the readme down the platform image table
     lines = response.split("\n")
-    plat_map = {}
-    for plat in PLATFORMS:
-        plat_latest = plat + "-latest"
-        for ln in lines:
-            if plat_latest not in ln:
-                continue
-            plat_map[plat] = (
-                re.match(".*(" + plat + "-.*)`.*", ln).groups(0)[0]
+    table_lines = []
+    in_images_section = False
+    for line in lines:
+        if not in_images_section and line.startswith("## Available Images"):
+            in_images_section = True
+            continue
+        elif in_images_section and line.startswith("#"):
+            break
+        elif not in_images_section:
+            continue
+
+        if line.startswith("|"):
+            table_lines.append(line.strip())
+
+    # Extract the table column labels
+    plat_col_labels = md_row_fields(table_lines[0])
+
+    platform_name_re = re.compile(r"`([^`]*)`")
+    entries = {}
+    for line in table_lines[2:]:
+        col_data = md_row_fields(line)
+        plat_entry = dict(zip(plat_col_labels, col_data))
+        raw_labels = plat_entry["YAML Label"]
+        available_labels = platform_name_re.findall(raw_labels)
+        try:
+            next(
+                label for label in available_labels
+                if label.split("-")[-1] == "latest"
             )
+        except StopIteration:
+            # not a latest label
+            continue
+
+        label = next(
+            label for label in available_labels
+            if label.split("-")[-1] not in {"xl", "latest"}
+        )
+        platform = label.split("-")[0]
+        if platform not in PLATFORMS:
+            continue
+        entries[platform] = label
+
+    return entries
+
+
+def main():
+    args = _parsed_args()
+
+    plat_map = fetch_plat_map()
 
     if args.freeze:
         freeze_ci(plat_map, args.dryrun)