diff --git a/.github/workflows/windows-npm.yml b/.github/workflows/windows-npm.yml
index 90dd6e11..29333351 100644
--- a/.github/workflows/windows-npm.yml
+++ b/.github/workflows/windows-npm.yml
@@ -107,10 +107,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # each line gets a pin, plus the newest setup-wsl offers for it; the
+        # newest only moves when the action's major does, so bumping the `uses:`
+        # ref below is what keeps this current
         wsl-distrib:
-          - Debian
-        # - Alpine # fails
+          - Debian-12
+          - Debian-13
+        # - Alpine-3.17 # fails
           - Ubuntu-20.04
+          - Ubuntu-24.04
           - Ubuntu-18.04
         npm-node-version:
           - '--lts'
@@ -128,31 +133,57 @@ jobs:
           - wsl-distrib: Ubuntu-18.04
             npm-node-version: '18'
           # node v24+ doesn't work on WSL1 (exec format error)
-          - wsl-distrib: Debian
+          - wsl-distrib: Debian-12
+            npm-node-version: '--lts'
+          - wsl-distrib: Debian-13
             npm-node-version: '--lts'
           - wsl-distrib: Ubuntu-20.04
             npm-node-version: '--lts'
+          - wsl-distrib: Ubuntu-24.04
+            npm-node-version: '--lts'
         method:
           - ''
           - 'script'
     steps:
       # For Ubuntu: install with packages directly
-      - if: matrix.wsl-distrib != 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ !startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget
 
-      # For Debian: install without packages first (apt-get update fails due to stale sources.list)
+      # For Debian, install without packages: `additional-packages` would run
+      # `apt-get update` before we get to fix up sources.list
       # see https://github.com/Vampire/setup-wsl/issues/76
-      - if: matrix.wsl-distrib == 'Debian'
-        uses: Vampire/setup-wsl@v6
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
-      - if: matrix.wsl-distrib == 'Debian'
+      # Debian's mirror layout shifts as a release ages out of LTS: main moves to
+      # archive.debian.org, and the security suite is both renamed and moved, on
+      # its own schedule. Offer every layout and let `apt-get update` discard the
+      # ones that 404, so this needs no edits as the image's release ages.
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
+        name: 'Point apt at whichever mirrors still carry this release'
         shell: 'wsl-bash {0}'
-        run: 'sed -i s/ftp.debian.org/archive.debian.org/ /etc/apt/sources.list'
-      - if: matrix.wsl-distrib == 'Debian'
+        run: |
+          codename="$(. /etc/os-release && printf '%s' "${VERSION_CODENAME-}")"
+          if [ -z "${codename}" ]; then
+            echo 'no VERSION_CODENAME in /etc/os-release' >&2
+            exit 1
+          fi
+          # Debian 13 moved to deb822; drop both formats so what we write is the
+          # only thing apt reads, whichever release is pinned
+          rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
+          {
+            echo "deb http://deb.debian.org/debian ${codename} main"
+            echo "deb http://archive.debian.org/debian ${codename} main"
+            echo "deb http://security.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}-security main"
+            echo "deb http://archive.debian.org/debian-security ${codename}/updates main"
+          } >/etc/apt/sources.list
+          cat /etc/apt/sources.list
+      - if: ${{ startsWith(matrix.wsl-distrib, 'Debian') }}
         name: 'Install packages with retries'
         shell: 'wsl-bash {0}'
         run: |
@@ -173,9 +204,15 @@ jobs:
               }
             done
           }
-          retry apt-get update
-          retry apt-get upgrade --yes
-          retry apt-get install --yes bash git curl ca-certificates wget
+          packages=(bash git curl ca-certificates wget)
+          retry apt-get update || true
+          if ! retry apt-get install --yes "${packages[@]}"; then
+            # a security index can outlive the pool objects it advertises, which
+            # no retry resolves; main is complete once a release is archived
+            sed -i '/debian-security/d' /etc/apt/sources.list
+            retry apt-get update || true
+            retry apt-get install --yes "${packages[@]}"
+          fi
 
       - name: Retrieve nvm on WSL
         run: |
@@ -204,7 +241,8 @@ jobs:
       fail-fast: false
       matrix:
         wsl-distrib:
-          - Alpine
+          - Alpine-3.17
+          - Alpine-3.23
         npm-node-version:
           - '--lts'
           - '21'
@@ -218,7 +256,7 @@ jobs:
           - ''
           - 'script'
     steps:
-      - uses: Vampire/setup-wsl@v6
+      - uses: Vampire/setup-wsl@v7
         with:
           distribution: ${{ matrix.wsl-distrib }}
           additional-packages: bash git curl ca-certificates wget