diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
index 7d853071ad..4a11134184 100644
--- a/.github/workflows/analysis.yml
+++ b/.github/workflows/analysis.yml
@@ -51,8 +51,10 @@ jobs:
     # account credentials.
     if: github.repository == 'AcademySoftwareFoundation/OpenImageIO'
     uses: ./.github/workflows/build-steps.yml
-    # Must let the called steps workflow inherit our secrets
-    secrets: inherit
+    # Must let the called steps workflow inherit necessary secrets
+    secrets:
+      PASSED_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PASSED_SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     with:
       nametag: ${{ matrix.nametag || 'unnamed!' }}
       runner: ${{ matrix.runner || 'ubuntu-latest' }}
diff --git a/.github/workflows/build-steps.yml b/.github/workflows/build-steps.yml
index d5a765b1e0..d2da331d22 100644
--- a/.github/workflows/build-steps.yml
+++ b/.github/workflows/build-steps.yml
@@ -64,6 +64,11 @@ on:
         type: string
       nametag:
         type: string
+    secrets:
+        PASSED_GITHUB_TOKEN:
+          required: false
+        PASSED_SONAR_TOKEN:
+          required: false
 
 permissions: read-all
 
@@ -145,8 +150,8 @@ jobs:
       - name: Sonar-scanner
         if: inputs.sonar == 1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PASSED_GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.PASSED_SONAR_TOKEN }}
         run: |
             which sonar-scanner
             ls -l /__w/OpenImageIO/OpenImageIO/bw_output
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 87a36a6311..e01b007841 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -588,7 +588,7 @@ jobs:
             runner: windows-2019
             vsver: 2019
             generator: "Visual Studio 16 2019"
-            python_ver: 3.7
+            python_ver: "3.9"
           - desc: Windows-2022 VS2022
             runner: windows-2022
             vsver: 2022
diff --git a/INSTALL.md b/INSTALL.md
index 0d5e38bb01..db0aaf1fa7 100644
--- a/INSTALL.md
+++ b/INSTALL.md
@@ -19,7 +19,7 @@ NEW or CHANGED MINIMUM dependencies since the last major release are **bold**.
        CMake configuration flag: `-DCMAKE_CXX_STANDARD=20`, etc.
  * Compilers: **gcc 9.3** - 14.2, **clang 5** - 19, MSVS 2017 - 2019 (**v19.14
    and up**), **Intel icc 19+**, Intel OneAPI C++ compiler 2022+.
- * **CMake >= 3.18.2** (tested through 3.30)
+ * **CMake >= 3.18.2** (tested through 3.31)
  * **Imath >= 3.1** (tested through 3.1.x and main)
  * **OpenEXR >= 3.1** (tested through 3.3 and main)
  * **libTIFF >= 4.0** (tested through 4.7)
diff --git a/src/build-scripts/build_cmake.bash b/src/build-scripts/build_cmake.bash
index 5f20ba1a1c..0a74413b2d 100755
--- a/src/build-scripts/build_cmake.bash
+++ b/src/build-scripts/build_cmake.bash
@@ -12,7 +12,7 @@ set -ex
 echo "Building cmake"
 uname
 
-CMAKE_VERSION=${CMAKE_VERSION:=3.18.5}
+CMAKE_VERSION=${CMAKE_VERSION:=3.31.3}
 LOCAL_DEPS_DIR=${LOCAL_DEPS_DIR:=${PWD}/ext}
 CMAKE_INSTALL_DIR=${CMAKE_INSTALL_DIR:=${LOCAL_DEPS_DIR}/cmake}
 
@@ -25,8 +25,8 @@ fi
 
 if [[ `uname` == "Linux" && `uname -m` == "aarch64" ]] ; then
     mkdir -p ${CMAKE_INSTALL_DIR} || true
-    curl --location https://anaconda.org/conda-forge/cmake/3.17.0/download/linux-aarch64/cmake-3.17.0-h28c56e5_0.tar.bz2 -o cmake-3.17.0-h28c56e5_0.tar.bz2
-    tar -xjf cmake-3.17.0-h28c56e5_0.tar.bz2 -C ${CMAKE_INSTALL_DIR}
+    curl --location "https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}/cmake-${CMAKE_VERSION}-Linux-aarch64.sh" -o "cmake.sh"
+    sh cmake.sh --skip-license --prefix=${CMAKE_INSTALL_DIR}
     export PATH=${CMAKE_INSTALL_DIR}/bin:$PATH
 
     # In case we ever need to build from scratch:
diff --git a/src/cmake/modules/FindLibRaw.cmake b/src/cmake/modules/FindLibRaw.cmake
index 2a48a33d29..6d3186e5ca 100644
--- a/src/cmake/modules/FindLibRaw.cmake
+++ b/src/cmake/modules/FindLibRaw.cmake
@@ -96,7 +96,7 @@ if (LINKSTATIC)
         set (LibRaw_r_LIBRARIES ${LibRaw_r_LIBRARIES} ${LCMS2_LIBRARIES})
     endif()
     if (MSVC)
-        set (LibRaw_r_DEFINITIONS ${LibRaw_r_DEFINITIONS} LIBRAW_NODLL)
-        set (LibRaw_DEFINITIONS ${LibRaw_DEFINITIONS} LIBRAW_NODLL)
+        set (LibRaw_r_DEFINITIONS ${LibRaw_r_DEFINITIONS} -D LIBRAW_NODLL)
+        set (LibRaw_DEFINITIONS ${LibRaw_DEFINITIONS} -D LIBRAW_NODLL)
     endif()
 endif ()