diff --git a/.github/workflows/cibuildwheel_config.toml b/.github/workflows/cibuildwheel_config.toml
index 78d5ab3..b4924cf 100644
--- a/.github/workflows/cibuildwheel_config.toml
+++ b/.github/workflows/cibuildwheel_config.toml
@@ -1,5 +1,4 @@
 [tool.cibuildwheel]
-skip = "cp36-*" # scikit-build-core requires >=3.7
 build-verbosity = 3
 
 [tool.cibuildwheel.linux]
@@ -15,6 +14,14 @@ repair-wheel-command = "auditwheel repair --exclude libEGL.so.1 -w {dest_dir} {w
 [tool.cibuildwheel.environment.linux]
 CMAKE_ARGS = "DPOLYSCOPE_BACKEND_OPENGL3_EGL=ON"
 
+# Required by nanobind for C++17. Technically it should be 10.14 
+# for full support, but this seems to work and gets us somewhat older 
+# compatibility.
+# There is a matching setting in pyproject.toml 
+# https://cibuildwheel.pypa.io/en/stable/cpp_standards/#macos-and-deployment-target-versions
+[tool.cibuildwheel.macos.environment]
+MACOSX_DEPLOYMENT_TARGET = "10.13"
+
 # musllinux builds on an Alpinx Linux image, need different package names
 [[tool.cibuildwheel.overrides]]
 select = "*-musllinux*"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a2779a2..21221a7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -26,6 +26,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
+      
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12' 
 
       - name: Package source distribution
         # make sure this only happens on one of the runners, not repeated on all
@@ -35,7 +39,7 @@ jobs:
           python -m build --sdist
 
       - name: Run cibuildwheel
-        uses: pypa/cibuildwheel@v2.23.2
+        uses: pypa/cibuildwheel@v3.3.0
         with:
           config-file: ".github/workflows/cibuildwheel_config.toml"
 
diff --git a/.github/workflows/test_build.yml b/.github/workflows/test_build.yml
index 00c6c36..cb00a24 100644
--- a/.github/workflows/test_build.yml
+++ b/.github/workflows/test_build.yml
@@ -1,4 +1,3 @@
-
 name: Test Build
 
 # NOTE: build logic is duplicated here and in publish.yml
@@ -22,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         # macos-13 is an intel runner, macos-14+ is apple silicon
-        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-13, macos-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-15-intel, macos-latest]
 
     name: Build wheels ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -32,6 +31,10 @@ jobs:
         with:
           submodules: 'recursive'
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12' 
+
       - name: Package source distribution
         # make sure this only happens on one of the runners, not repeated on all
         if: matrix.os == 'ubuntu-latest'
@@ -40,7 +43,7 @@ jobs:
           python -m build --sdist
 
       - name: Run cibuildwheel
-        uses: pypa/cibuildwheel@v2.23.2
+        uses: pypa/cibuildwheel@v3.3.0
         with:
           config-file: ".github/workflows/cibuildwheel_config.toml"
 
diff --git a/pyproject.toml b/pyproject.toml
index f2dffdc..39550ee 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,7 +15,7 @@ classifiers = [
   "License :: OSI Approved :: MIT License",
   "Programming Language :: Python :: 3",
 ]
-requires-python = ">=3.7"
+requires-python = ">=3.9"
 
 dependencies = [
   "numpy",
@@ -33,4 +33,10 @@ build-backend = "scikit_build_core.build"
 
 [tool.scikit-build]
 build.verbose = true
-logging.level = "INFO"
\ No newline at end of file
+logging.level = "INFO"
+
+# Required by nanobind for C++17. Technically it should be 10.14 
+# for full support, but this seems to work and gets us somewhat older 
+# compatibility.
+# There is a matching setting in cibuildwheel_config.toml 
+cmake.args = ["-DCMAKE_OSX_DEPLOYMENT_TARGET=10.13"]
\ No newline at end of file