diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index dedbc9e5..9b91df95 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,52 +1,76 @@
 ---
 name: CI
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 on: # yamllint disable-line rule:truthy
   pull_request:
     branches: [main]
   workflow_dispatch:
   schedule:
     - cron: 0 0 * * *
 
 jobs:
   changelog:
     uses: ansible/ansible-content-actions/.github/workflows/changelog.yaml@main
     if: github.event_name == 'pull_request'
   build-import:
     uses: ansible/ansible-content-actions/.github/workflows/build_import.yaml@main
   ansible-lint:
     uses: ansible/ansible-content-actions/.github/workflows/ansible_lint.yaml@main
   sanity:
     uses: ansible/ansible-content-actions/.github/workflows/sanity.yaml@main
   unit-galaxy:
     uses: ansible/ansible-content-actions/.github/workflows/unit.yaml@main
   unit-source:
     uses: ansible-network/github_actions/.github/workflows/unit_source.yml@main
     with:
       collection_pre_install: >-
         git+https://github.com/ansible-collections/ansible.utils.git
         git+https://github.com/ansible-collections/ansible.netcommon.git
+      matrix_exclude: >-
+        [
+          {"ansible-version": "devel", "python-version": "3.11"},
+          {"ansible-version": "devel", "python-version": "3.14"},
+          {"ansible-version": "devel", "python-version": "3.10"},
+          {"ansible-version": "devel", "python-version": "3.12"},
+          {"ansible-version": "milestone", "python-version": "3.14"},
+          {"ansible-version": "milestone", "python-version": "3.11"},
+          {"ansible-version": "milestone", "python-version": "3.10"},
+          {"ansible-version": "stable-2.20", "python-version": "3.14"},
+          {"ansible-version": "stable-2.20", "python-version": "3.11"},
+          {"ansible-version": "stable-2.20", "python-version": "3.10"},
+          {"ansible-version": "stable-2.21", "python-version": "3.11"},
+          {"ansible-version": "stable-2.21", "python-version": "3.10"},
+          {"ansible-version": "stable-2.19", "python-version": "3.14"},
+          {"ansible-version": "stable-2.19", "python-version": "3.10"},
+          {"ansible-version": "stable-2.18", "python-version": "3.14"},
+          {"ansible-version": "stable-2.18", "python-version": "3.10"},
+          {"ansible-version": "stable-2.17", "python-version": "3.14"},
+          {"ansible-version": "stable-2.17", "python-version": "3.13"},
+          {"ansible-version": "stable-2.16", "python-version": "3.14"},
+          {"ansible-version": "stable-2.16", "python-version": "3.13"},
+          {"ansible-version": "stable-2.16", "python-version": "3.12"}
+        ]
   all_green:
     if: ${{ always() }}
     needs:
       - changelog
       - build-import
       - sanity
       - unit-galaxy
       - unit-source
       - ansible-lint
     runs-on: ubuntu-latest
     steps:
       - run: >-
           python -c "assert 'failure' not in
           set([
           '${{ needs.changelog.result }}',
           '${{ needs.sanity.result }}',
           '${{ needs.unit-galaxy.result }}'
           '${{ needs.ansible-lint.result }}'
           '${{ needs.unit-source.result }}'
           ])"
diff --git a/changelogs/fragments/vyos-user-update-password-no-log.yml b/changelogs/fragments/vyos-user-update-password-no-log.yml
index d1c74876..b20a3955 100644
--- a/changelogs/fragments/vyos-user-update-password-no-log.yml
+++ b/changelogs/fragments/vyos-user-update-password-no-log.yml
@@ -1,3 +1,3 @@
 ---
 bugfixes:
-  - vyos_user - Set explicit no_log=False on update_password so Ansible does not apply the PASSWORD_MATCH heuristic that hides password-named parameters when no_log is unset.
+  - vyos_user - Set explicit no_log=False on update_password so PASSWORD_MATCH does not hide it when no_log is unset.
diff --git a/tox-ansible.ini b/tox-ansible.ini
index 5d3c8ddd..c058cb65 100644
--- a/tox-ansible.ini
+++ b/tox-ansible.ini
@@ -1,4 +1,5 @@
 [ansible]
 skip =
     py3.13
     py3.14
+    py3.12-devel