diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 663dc4d20..c1c4a1ee2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,11 +33,11 @@ jobs:
           # We need branches and tags since package leans on `git describe`. Passing 0 gets us
           # complete history.
           fetch-depth: 0
-      - name: Setup Python 3.8
+      - name: Setup Python 3.9
         uses: actions/setup-python@v5
         with:
-          # We need to keep Python 3.8 for consistent vendoring with tox.
-          python-version: "3.8"
+          # We need to keep Python 3.9 for consistent vendoring with tox.
+          python-version: "3.9"
       - name: Check Formatting, Lints and Types
         uses: pantsbuild/actions/run-tox@b16b9cf47cd566acfe217b1dafc5b452e27e6fd7
         with:
diff --git a/pex/interpreter_constraints.py b/pex/interpreter_constraints.py
index 770a47faa..9b8ceb273 100644
--- a/pex/interpreter_constraints.py
+++ b/pex/interpreter_constraints.py
@@ -373,7 +373,7 @@ def iter_compatible_versions(
     PythonVersion(Lifecycle.EOL, 3, 5, 10),
     PythonVersion(Lifecycle.EOL, 3, 6, 15),
     PythonVersion(Lifecycle.EOL, 3, 7, 17),
-    PythonVersion(Lifecycle.STABLE, 3, 8, 20),
+    PythonVersion(Lifecycle.EOL, 3, 8, 20),
     PythonVersion(Lifecycle.STABLE, 3, 9, 20),
     PythonVersion(Lifecycle.STABLE, 3, 10, 15),
     PythonVersion(Lifecycle.STABLE, 3, 11, 10),
diff --git a/scripts/typecheck.py b/scripts/typecheck.py
index 2436ab245..ad6840e97 100755
--- a/scripts/typecheck.py
+++ b/scripts/typecheck.py
@@ -42,12 +42,12 @@ def main() -> None:
         "2.7", files=sorted(find_files_to_check(include=["build-backend"])), subject="build-backend"
     )
     run_mypy(
-        "3.8",
+        "3.9",
         files=sorted(find_files_to_check(include=["docs"])),
         subject="sphinx_pex",
     )
     run_mypy(
-        "3.8", files=sorted(find_files_to_check(include=["package", "scripts"])), subject="scripts"
+        "3.9", files=sorted(find_files_to_check(include=["package", "scripts"])), subject="scripts"
     )
 
     source_and_tests = sorted(
@@ -56,7 +56,7 @@ def main() -> None:
             exclude=[os.path.join("pex", "vendor", "_vendored")],
         )
     )
-    for python_version in ("3.13", "3.12", "3.5", "2.7"):
+    for python_version in ("3.13", "3.5", "2.7"):
         run_mypy(python_version, files=source_and_tests)
 
 
diff --git a/tox.ini b/tox.ini
index 08f680d01..22b3e404c 100644
--- a/tox.ini
+++ b/tox.ini
@@ -155,7 +155,15 @@ deps =
     packaging==20.9  # This version should track the lowest version in pex/vendor/__init__.py.
     pip==20.3.4  # This version should track the version in pex/vendor/__init__.py.
     setuptools==44.0.0  # This version should track the version in pex/vendor/__init__.py.
+
     sphinx
+    # This is just used as a constraint - the dep is via:
+    #   spinx 5.1.1 -> jinja2>=2.3 -> MarkupSafe>=2.0
+    # This works around a mypy bug handling positional-only arguments for `--python-version` >=3.8
+    # that was not fixed until 0.981 (we're stuck on 0.971). MarkupSafe>=3 uses positional argument
+    # only notation.
+    MarkupSafe<3
+
     toml==0.10.2  # This version should track the version in pex/vendor/__init__.py.
 
     PyGithub==2.4.0
@@ -180,7 +188,7 @@ commands =
 # The vendored dist may contain references to the python version it was built on
 # (e.g., pex/vendor/_vendored/pip/pip-20.0.dev0.dist-info/entry_points.txt).
 # So this test restricts the python version, to prevent spurious diffs that will cause it to fail.
-basepython = python3.8
+basepython = python3.9
 skip_install = true
 deps =
     ansicolors==1.1.8