Instead of using `-latest` runners, pin the runners we are using to prevent an upgrade from breaking stuff