diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a0ba90..49008f1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,7 +1,11 @@
 ---
 name: Build
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main, test-me-*]
+    tags: '*'
+  pull_request:
 
 jobs:
   build_sdist:
@@ -35,12 +39,17 @@ jobs:
           path: pre_build.sh
 
   build_wheels:
-    name: Build wheels for ${{ matrix.os }}
+    name: Build wheels for ${{ matrix.os }} ${{ matrix.arch }}
     needs: [build_sdist]
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04, macos-11]
+        include:
+        - {os: ubuntu-latest, arch: aarch64}
+        - {os: ubuntu-latest, arch: i686}
+        - {os: ubuntu-latest, arch: x86_64}
+        - {os: macos-13, arch: x86_64}
+        - {os: macos-14, arch: arm64}
       fail-fast: false
 
     steps:
@@ -62,25 +71,23 @@ jobs:
           chmod +x pre_build.sh
 
       - name: Set up QEMU
-        if: runner.os == 'Linux'
+        if: matrix.arch == 'aarch64'
         uses: docker/setup-qemu-action@v1
         with:
           platforms: all
 
+      - name: avoid homebrew pcre2
+        if: matrix.os == 'macos-14'
+        run: brew unlink pcre2
+
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.16.2
+        uses: pypa/cibuildwheel@v2.20.0
         with:
           output-dir: dist
           package-dir: ./${{ needs.build_sdist.outputs.sdist_name }}
         env:
-          CIBW_ARCHS_LINUX: auto aarch64
-          CIBW_ARCHS_MACOS: x86_64
-          # cross-compile for arm64 on macos isn't working yet
-          # https://github.com/lincolnloop/pyuwsgi-wheels/issues/18
-          # CIBW_ARCHS_MACOS: x86_64 arm64
-          # tesing on emulated arm64 isn't supported for MacOS
-          # CIBW_TEST_SKIP: "*-macosx_arm64"
-          CIBW_SKIP: cp36-* pp*
+          CIBW_ARCHS: ${{ matrix.arch }}
+          CIBW_SKIP: cp36-* cp38-macosx_arm64 cp313-* pp*
           CIBW_ENVIRONMENT: APPEND_VERSION="" UWSGI_PROFILE=pyuwsginossl
           CIBW_TEST_COMMAND: "pyuwsgi --help"
           CIBW_BEFORE_BUILD_MACOS: "find . -name '*.o' -delete && IS_MACOS=1 ./pre_build.sh"
diff --git a/Makefile b/Makefile
index b89da44..d0c09cf 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ SHELL := bash
 # Figure out what version we're building
 UPSTREAM_VERSION := $(shell cd uwsgi; python setup.pyuwsgi.py --version)
 # super fragile way of extracting `APPEND_VERSION` from workflow 🤮
-APPEND_VERSION := $(shell yq e '.jobs.build_wheels.steps[4].env.CIBW_ENVIRONMENT' .github/workflows/build.yml | cut -d' ' -f1 | cut -d= -f2)
+APPEND_VERSION := $(shell yq e '.jobs.build_wheels.steps[5].env.CIBW_ENVIRONMENT' .github/workflows/build.yml | cut -d' ' -f1 | cut -d= -f2)
 VERSION := $(UPSTREAM_VERSION)$(APPEND_VERSION)
 HASH := $(shell cd uwsgi; git rev-parse HEAD)
 
diff --git a/pre_build.sh b/pre_build.sh
index f69c88c..b93d24e 100755
--- a/pre_build.sh
+++ b/pre_build.sh
@@ -1,14 +1,32 @@
 #!/bin/bash
 set -eu -o pipefail
 
+if [ -n "${IS_MACOS:-}" ]; then
+  # make sure the linked binaries are equivalent to our target
+  python="$(command -v python)"
+  min_ver="$(
+    otool -l "$python" |
+    grep -A2 LC_VERSION_MIN_MACOSX |
+    tail -1 |
+    awk '{print $2}'
+  )"
+  export MACOSX_DEPLOYMENT_TARGET="$min_ver"
+  make_install=(sudo make install)
+else
+  make_install=(make install)
+fi
+
 JANSSON_HASH=6e85f42dabe49a7831dbdd6d30dca8a966956b51a9a50ed534b82afc3fa5b2f4
 JANSSON_DOWNLOAD_URL=http://www.digip.org/jansson/releases
 JANSSON_ROOT=jansson-2.11
 
+PCRE2_HASH=86b9cb0aa3bcb7994faa88018292bc704cdbb708e785f7c74352ff6ea7d3175b
+PCRE2_DOWNLOAD_URL=https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.44/pcre2-10.44.tar.gz
+PCRE2_ROOT=pcre2-10.44
+
 # From Multibuild
 BUILD_PREFIX="${BUILD_PREFIX:-/usr/local}"
 MULTIBUILD_DIR=$(dirname "${BASH_SOURCE[0]}")
-PCRE_VERSION="${PCRE_VERSION:-8.38}"
 function rm_mkdir {
     # Remove directory if present, then make directory
     local path=$1
@@ -16,26 +34,6 @@ function rm_mkdir {
     if [ -d "$path" ]; then rm -rf "$path"; fi
     mkdir "$path"
 }
-function build_simple {
-    # Example: build_simple libpng $LIBPNG_VERSION \
-    #               https://download.sourceforge.net/libpng tar.gz
-    local name="$1"
-    local version="$2"
-    local url="$3"
-    local ext="${4:-tar.gz}"
-    echo "building $name@$version from $3"
-    if [ -e "${name}-stamp" ]; then
-        return
-    fi
-    local name_version="${name}-${version}"
-    local archive="${name_version}.${ext}"
-    fetch_unpack "$url/$archive"
-    (cd "$name_version" \
-        && ./configure --prefix="$BUILD_PREFIX" \
-        && make -j4 \
-        && make install)
-    touch "${name}-stamp"
-}
 function fetch_unpack {
     # Fetch input archive name from input URL
     # Parameters
@@ -74,8 +72,16 @@ function fetch_unpack {
 #        ls -1d * &&
 #        rsync --delete -ah * ..)
 }
-function build_pcre {
-    build_simple pcre "$PCRE_VERSION" https://s3.amazonaws.com/ll-share-public/pcre
+function build_pcre2 {
+    if [ -e pcre2-stamp ]; then return; fi
+    echo "building pcre2 from $PCRE2_DOWNLOAD_URL"
+    fetch_unpack "${PCRE2_DOWNLOAD_URL}"
+    check_sha256sum "${ARCHIVES_SDIR:-archives}/${PCRE2_ROOT}.tar.gz" "$PCRE2_HASH"
+    (cd "${PCRE2_ROOT}" \
+        && ./configure --prefix="$BUILD_PREFIX" \
+        && make -j4 \
+        && "${make_install[@]}")
+    touch pcre2-stamp
 }
 
 function check_sha256sum {
@@ -102,12 +108,12 @@ function build_jansson {
     (cd "${JANSSON_ROOT}" \
         && ./configure --prefix="$BUILD_PREFIX" \
         && make -j4 \
-        && make install)
+        && "${make_install[@]}")
     touch jansson-stamp
 }
 
 function pre_build {
-    build_pcre
+    build_pcre2
     #build_zlib
     build_jansson
 }
diff --git a/uwsgi b/uwsgi
index 3a28185..578dfca 160000
--- a/uwsgi
+++ b/uwsgi
@@ -1 +1 @@
-Subproject commit 3a28185f9c23a16ed9495a099ca0fea0e28473ab
+Subproject commit 578dfcab74e976227be44fa94980ab3abe4cbbc5