diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index c7b25a2..c898837 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -10,10 +10,12 @@ on:
 
 jobs:
   check-format:
-    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
         include:
           - example: default
             errors: 3
@@ -23,11 +25,12 @@ jobs:
             errors: 1
           - example: format-ignore
             errors: 0
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - shell: bash
         run: |
-          set -x
+          set -euxo pipefail
 
           cd example/${{ matrix.example }}
 
@@ -86,12 +89,16 @@ jobs:
 
           bazel build --config=clang-format-fix
 
+  # https://emmer.dev/blog/skippable-github-status-checks-aren-t-really-required/
+  # https://github.com/marketplace/actions/alls-green
   all:
     runs-on: ubuntu-latest
-    if: ${{ github.base_ref == 'main' }}
+    if: always()
     needs:
       - check-format
       - fix-format
       - bazel-version
     steps:
-    - run: true
+    - uses: re-actors/alls-green@release/v1
+      with:
+        jobs: ${{ toJSON(needs) }}
diff --git a/defs.bzl b/defs.bzl
index 3b8d012..b6da316 100644
--- a/defs.bzl
+++ b/defs.bzl
@@ -29,7 +29,7 @@ set -euo pipefail
 # although newer versions of clang-format (e.g. 18.1.4) *do* appear to work
 # with symlinks
 #
-{binary} -style=file:{config} {format_options} $(readlink --canonicalize {infile})
+{binary} -style=file:{config} {format_options} $(readlink -f {infile})
 
 touch {outfile}
 """.format(
diff --git a/example/format-binary/.bazelrc b/example/format-binary/.bazelrc
index e1bb847..b87885c 100644
--- a/example/format-binary/.bazelrc
+++ b/example/format-binary/.bazelrc
@@ -1,6 +1,6 @@
 common --enable_bzlmod=false
 
-build:clang-format-base --@bazel_clang_format//:binary=@llvm14//:clang-format
+build:clang-format-base --@bazel_clang_format//:binary=@llvm18//:clang-format
 build:clang-format-base --output_groups=report
 build:clang-format-base --keep_going
 
diff --git a/example/format-binary/WORKSPACE.bazel b/example/format-binary/WORKSPACE.bazel
index 55ee172..8188ed8 100644
--- a/example/format-binary/WORKSPACE.bazel
+++ b/example/format-binary/WORKSPACE.bazel
@@ -5,30 +5,30 @@ local_repository(
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-BAZEL_TOOLCHAIN_COMMIT = "66f938c956d247d01997ecfc84725f165ceaf1ed"
+TOOLCHAINS_LLVM_COMMIT = "b1a6c86b42ee2373574d0e6862d9d9d5405c3146"
 
 http_archive(
-    name = "com_grail_bazel_toolchain",
-    integrity = "sha256-Gf4ow1hoJKbokzIAiGXv9PskwCR63o9ryKN+CLsaemw=",
+    name = "toolchains_llvm",
+    integrity = "sha256-hdEfwQEvZaPD/gp6A9iDSIxxKOBYrn+ttFYjAHfFby8=",
     strip_prefix = "bazel-toolchain-{commit}".format(
-        commit = BAZEL_TOOLCHAIN_COMMIT,
+        commit = TOOLCHAINS_LLVM_COMMIT,
     ),
     url = "https://github.com/oliverlee/bazel-toolchain/archive/{commit}.tar.gz".format(
-        commit = BAZEL_TOOLCHAIN_COMMIT,
+        commit = TOOLCHAINS_LLVM_COMMIT,
     ),
 )
 
-load("@com_grail_bazel_toolchain//toolchain:deps.bzl", "bazel_toolchain_dependencies")
+load("@toolchains_llvm//toolchain:deps.bzl", "bazel_toolchain_dependencies")
 
 bazel_toolchain_dependencies()
 
-load("@com_grail_bazel_toolchain//toolchain:rules.bzl", "llvm_toolchain")
+load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
 
 llvm_toolchain(
-    name = "llvm14",
-    llvm_version = "14.0.0",
+    name = "llvm18",
+    llvm_version = "18.1.8",
 )
 
-load("@llvm14//:toolchains.bzl", "llvm_register_toolchains")
+load("@llvm18//:toolchains.bzl", "llvm_register_toolchains")
 
 llvm_register_toolchains()
diff --git a/example/format-ignore/.bazelrc b/example/format-ignore/.bazelrc
index 858b21e..a6fb558 100644
--- a/example/format-ignore/.bazelrc
+++ b/example/format-ignore/.bazelrc
@@ -1,6 +1,6 @@
 common --enable_bzlmod=false
 
-build:clang-format-base --@bazel_clang_format//:binary=@llvm14//:clang-format
+build:clang-format-base --@bazel_clang_format//:binary=@llvm18//:clang-format
 build:clang-format-base --@bazel_clang_format//:ignore=//:clang-format-ignore
 build:clang-format-base --output_groups=report
 build:clang-format-base --keep_going
diff --git a/example/format-ignore/WORKSPACE.bazel b/example/format-ignore/WORKSPACE.bazel
index 55ee172..8188ed8 100644
--- a/example/format-ignore/WORKSPACE.bazel
+++ b/example/format-ignore/WORKSPACE.bazel
@@ -5,30 +5,30 @@ local_repository(
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-BAZEL_TOOLCHAIN_COMMIT = "66f938c956d247d01997ecfc84725f165ceaf1ed"
+TOOLCHAINS_LLVM_COMMIT = "b1a6c86b42ee2373574d0e6862d9d9d5405c3146"
 
 http_archive(
-    name = "com_grail_bazel_toolchain",
-    integrity = "sha256-Gf4ow1hoJKbokzIAiGXv9PskwCR63o9ryKN+CLsaemw=",
+    name = "toolchains_llvm",
+    integrity = "sha256-hdEfwQEvZaPD/gp6A9iDSIxxKOBYrn+ttFYjAHfFby8=",
     strip_prefix = "bazel-toolchain-{commit}".format(
-        commit = BAZEL_TOOLCHAIN_COMMIT,
+        commit = TOOLCHAINS_LLVM_COMMIT,
     ),
     url = "https://github.com/oliverlee/bazel-toolchain/archive/{commit}.tar.gz".format(
-        commit = BAZEL_TOOLCHAIN_COMMIT,
+        commit = TOOLCHAINS_LLVM_COMMIT,
     ),
 )
 
-load("@com_grail_bazel_toolchain//toolchain:deps.bzl", "bazel_toolchain_dependencies")
+load("@toolchains_llvm//toolchain:deps.bzl", "bazel_toolchain_dependencies")
 
 bazel_toolchain_dependencies()
 
-load("@com_grail_bazel_toolchain//toolchain:rules.bzl", "llvm_toolchain")
+load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
 
 llvm_toolchain(
-    name = "llvm14",
-    llvm_version = "14.0.0",
+    name = "llvm18",
+    llvm_version = "18.1.8",
 )
 
-load("@llvm14//:toolchains.bzl", "llvm_register_toolchains")
+load("@llvm18//:toolchains.bzl", "llvm_register_toolchains")
 
 llvm_register_toolchains()