diff --git a/.github/workflows/build_unix.yaml b/.github/workflows/build_unix.yaml
index dbee9cce631..0a997e5b096 100644
--- a/.github/workflows/build_unix.yaml
+++ b/.github/workflows/build_unix.yaml
@@ -22,13 +22,28 @@ jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
+      # Don't let one leg's failure cancel the others — a new/older OS version
+      # breaking must not stop the proven ones from building and uploading.
+      fail-fast: false
       matrix:
         include:
+          # FreeBSD: keep 14.x and track 15.x (OPNsense 25.7+ is FreeBSD 15).
           - os: freebsd
+            release: "14.3"
             assetName: cloudflared-freebsd14-amd64
+          - os: freebsd
+            release: "15.1"
+            assetName: cloudflared-freebsd15-amd64
+          # NetBSD: keep 10.x and add 11.0.
           - os: netbsd
+            release: "10.1"
             assetName: cloudflared-netbsd10-amd64
+          - os: netbsd
+            release: "11.0"
+            assetName: cloudflared-netbsd11-amd64
+          # OpenBSD: single latest release.
           - os: openbsd
+            release: "7.9"
             assetName: cloudflared-openbsd7-amd64
     env:
       GOEXPERIMENT: "noboringcrypto"
@@ -76,7 +91,7 @@ jobs:
         if: matrix.os == 'freebsd'
         uses: vmactions/freebsd-vm@v1
         with:
-          release: "14.3"
+          release: "${{ matrix.release }}"
           envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN"
           usesh: true
           mem: 4096
@@ -117,7 +132,7 @@ jobs:
         if: matrix.os == 'netbsd'
         uses: vmactions/netbsd-vm@v1
         with:
-          release: "10.1"
+          release: "${{ matrix.release }}"
           envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN"
           usesh: true
           mem: 4096
@@ -149,13 +164,17 @@ jobs:
         if: matrix.os == 'openbsd'
         uses: vmactions/openbsd-vm@v1
         with:
-          release: "7.8"
+          release: "${{ matrix.release }}"
           envs: "GOEXPERIMENT CGO_ENABLED GOTOOLCHAIN"
           usesh: true
           mem: 4096
           prepare: |
-            pkg_add -xaz gmake sudo-- bash git go curl wget libffi ruby-34
-            gem34 install fpm
+            # cloudflared's build target only runs `gmake cloudflared` and never
+            # invokes fpm, so ruby/gem are intentionally omitted. On OpenBSD 7.9
+            # ruby 4.0 became the default and `pkg_add ruby-34` fuzzy-matched to
+            # ruby-4.0 (which ships gem40, not gem34), breaking the leg; dropping
+            # the unused ruby/fpm install removes that version-drift failure mode.
+            pkg_add -xaz gmake sudo-- bash git go curl wget
             git config --global --add safe.directory /home/runner/work/cloudflared/cloudflared
           run: |
             # Do NOT run `go mod tidy` here — it sees only the current GOOS's