diff --git a/.gitea/workflows/e2e.yml b/.gitea/workflows/e2e.yml
index c214aa3..f4ff79a 100644
--- a/.gitea/workflows/e2e.yml
+++ b/.gitea/workflows/e2e.yml
@@ -38,12 +38,13 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             debootstrap squashfs-tools \
             systemd-ukify systemd-boot kmod \
-            debian-archive-keyring python3-pip zstd \
+            debian-archive-keyring python3-pip git zstd \
             qemu-system-x86 qemu-utils \
             dnsmasq iperf3 ipxe-qemu
           # See release.yml for rationale — Ubuntu's apt mkosi is too old
           # to handle bookworm's non-free-firmware component correctly.
-          sudo pip install --break-system-packages mkosi==24.3
+          sudo pip install --break-system-packages \
+            "git+https://github.com/systemd/mkosi.git@v24.3"
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 3b60d01..0741774 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -35,12 +35,13 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             debootstrap squashfs-tools dosfstools \
             systemd-ukify systemd-boot kmod \
-            debian-archive-keyring python3-pip zstd
+            debian-archive-keyring python3-pip git zstd
           # Ubuntu's apt-packaged mkosi is too old to wire
           # non-free-firmware shorthand through to debootstrap.
-          # Install a pinned recent version directly; mkosi is
-          # pure-Python so --break-system-packages is harmless here.
-          sudo pip install --break-system-packages mkosi==24.3
+          # mkosi isn't published on PyPI under v24+ — install the
+          # pinned tag from upstream git instead.
+          sudo pip install --break-system-packages \
+            "git+https://github.com/systemd/mkosi.git@v24.3"
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001