diff --git a/.cirrus.yml b/.cirrus.yml
index c94273d0cf..915bac58b9 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -51,7 +51,7 @@ sanitizers_resource_template: &SANITIZERS_RESOURCE_TEMPLATE
   # For greediness, see https://medium.com/cirruslabs/introducing-greedy-container-instances-29aad06dc2b4
   greedy: true
 
-ci_template: &CI_TEMPLATE
+branch_whitelist: &BRANCH_WHITELIST
   # Rules for skipping builds:
   # - Don't do darwin builds on zeek-security repo because they use up a ton of compute credits.
   # - Always build PRs, but not if they come from dependabot
@@ -66,6 +66,9 @@ ci_template: &CI_TEMPLATE
       )
     ) )
 
+ci_template: &CI_TEMPLATE
+  << : *BRANCH_WHITELIST
+
   # Default timeout is 60 minutes, Cirrus hard limit is 120 minutes for free
   # tasks, so may as well ask for full time.
   timeout_in: 120m
@@ -264,16 +267,16 @@ alpine_task:
 
 # Apple doesn't publish official long-term support timelines.
 # We aim to support both the current and previous macOS release.
-macos_monterey_task:
+macos_ventura_task:
   macos_instance:
-    image: ghcr.io/cirruslabs/macos-monterey-base:latest
+    image: ghcr.io/cirruslabs/macos-ventura-base:latest
   prepare_script: ./ci/macos/prepare.sh
   << : *CI_TEMPLATE
   << : *MACOS_ENVIRONMENT
 
-macos_big_sur_task:
+macos_monterey_task:
   macos_instance:
-    image: big-sur-xcode-12.5
+    image: ghcr.io/cirruslabs/macos-monterey-base:latest
   prepare_script: ./ci/macos/prepare.sh
   << : *CI_TEMPLATE
   << : *MACOS_ENVIRONMENT
@@ -384,3 +387,4 @@ windows_task:
     ZEEK_CI_CPUS: 8
     # Give verbose error output on a test failure.
     CTEST_OUTPUT_ON_FAILURE: 1
+  << : *BRANCH_WHITELIST
diff --git a/CHANGES b/CHANGES
index 1745d822a0..16927085b4 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+5.2.0-dev.442 | 2023-01-03 12:09:10 -0700
+
+  * CI: avoid doing Windows builds with every push (Tim Wojtulewicz, Corelight)
+
+  * CI: drop macOS Big Sur, add macOS Ventura (Tim Wojtulewicz, Corelight)
+
 5.2.0-dev.437 | 2022-12-16 08:16:30 -0700
 
   * GH-2637: Re-remove the bro symlink wrapper (Tim Wojtulewicz, Corelight)
diff --git a/VERSION b/VERSION
index 1d8f8c99cb..87ee330680 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.2.0-dev.439
+5.2.0-dev.442
diff --git a/ci/init-external-repos.sh b/ci/init-external-repos.sh
index fa66edec3f..ce2d3f4a6d 100755
--- a/ci/init-external-repos.sh
+++ b/ci/init-external-repos.sh
@@ -51,7 +51,13 @@ if [[ -n "${CIRRUS_CI}" ]] && [[ "${CIRRUS_REPO_OWNER}" == "zeek" ]] && [[ ! -d
 
     banner "Trying to clone zeek-testing-private git repo"
     echo "${ZEEK_TESTING_PRIVATE_SSH_KEY}" >cirrus_key.b64
-    base64 -d cirrus_key.b64 >cirrus_key
+    if [ "${CIRRUS_TASK_NAME}" == "macos_ventura" ]; then
+        # The base64 command provided with macOS Ventura requires an argument
+        # to pass the input filename
+        base64 -d -i cirrus_key.b64 >cirrus_key
+    else
+        base64 -d cirrus_key.b64 >cirrus_key
+    fi
     rm cirrus_key.b64
     chmod 600 cirrus_key
     git --version