diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 44d373b16..2d1e7f9bc 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -97,13 +97,13 @@ jobs:
 
   ci_cmake_options:
     runs-on: ubuntu-latest
-    container: ubuntu:focal
+    container: ubuntu:24.04
     strategy:
       matrix:
         target: [ci_cmake_flags, ci_test_diagnostics, ci_test_diagnostic_positions, ci_test_noexceptions, ci_test_noimplicitconversions, ci_test_legacycomparison, ci_test_noglobaludls, ci_test_disableenumserialization, ci_test_skiplibraryversioncheck, ci_test_simdutf, ci_test_strict_nul_handling, ci_test_no_thread_local]
     steps:
       - name: Install build-essential
-        run: apt-get update ; apt-get install -y build-essential unzip wget git libssl-dev
+        run: apt-get update ; apt-get install -y build-essential unzip wget git
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
diff --git a/cmake/ci.cmake b/cmake/ci.cmake
index 0f434f46a..63771ac80 100644
--- a/cmake/ci.cmake
+++ b/cmake/ci.cmake
@@ -598,17 +598,36 @@ add_custom_target(ci_benchmarks
 
 function(ci_get_cmake version var)
     set(${var} ${PROJECT_BINARY_DIR}/cmake-${version}/bin/cmake)
-    add_custom_command(
-        OUTPUT ${${var}}
-        COMMAND wget -nc https://github.com/Kitware/CMake/releases/download/v${version}/cmake-${version}.tar.gz
-        COMMAND tar xfz cmake-${version}.tar.gz
-        COMMAND rm cmake-${version}.tar.gz
-        # -DCMAKE_POLICY_VERSION_MINIMUM=3.5 required to compile older CMake versions with CMake 4.0.0
-        COMMAND cmake -S cmake-${version} -B cmake-${version} -DCMAKE_POLICY_VERSION_MINIMUM=3.5
-        COMMAND cmake --build cmake-${version} --parallel 10
-        WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
-        COMMENT "Download CMake ${version}"
-    )
+    if(CMAKE_HOST_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "^(x86_64|amd64)$")
+        # Kitware publishes a prebuilt Linux x86_64 archive for every release; unpacking it is far
+        # cheaper than compiling all of CMake (including its own test helpers) from source.
+        add_custom_command(
+            OUTPUT ${${var}}
+            COMMAND wget -nc https://github.com/Kitware/CMake/releases/download/v${version}/cmake-${version}-linux-x86_64.tar.gz
+            COMMAND wget -nc https://github.com/Kitware/CMake/releases/download/v${version}/cmake-${version}-SHA-256.txt
+            # verify the archive against Kitware's published SHA-256 sums before unpacking it
+            COMMAND sh -c "grep ' cmake-${version}-linux-x86_64[.]tar[.]gz$' cmake-${version}-SHA-256.txt | sha256sum -c -"
+            COMMAND tar xfz cmake-${version}-linux-x86_64.tar.gz
+            COMMAND rm cmake-${version}-linux-x86_64.tar.gz cmake-${version}-SHA-256.txt
+            COMMAND ${CMAKE_COMMAND} -E rm -rf cmake-${version}
+            COMMAND ${CMAKE_COMMAND} -E rename cmake-${version}-linux-x86_64 cmake-${version}
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Download prebuilt CMake ${version}"
+        )
+    else()
+        # no prebuilt archive for this platform (e.g. macOS or Linux aarch64): build from source
+        add_custom_command(
+            OUTPUT ${${var}}
+            COMMAND wget -nc https://github.com/Kitware/CMake/releases/download/v${version}/cmake-${version}.tar.gz
+            COMMAND tar xfz cmake-${version}.tar.gz
+            COMMAND rm cmake-${version}.tar.gz
+            # -DCMAKE_POLICY_VERSION_MINIMUM=3.5 required to compile older CMake versions with CMake 4.0.0
+            COMMAND cmake -S cmake-${version} -B cmake-${version} -DCMAKE_POLICY_VERSION_MINIMUM=3.5
+            COMMAND cmake --build cmake-${version} --parallel 10
+            WORKING_DIRECTORY ${PROJECT_BINARY_DIR}
+            COMMENT "Download and build CMake ${version} from source"
+        )
+    endif()
     set(${var} ${${var}} PARENT_SCOPE)
 endfunction()