diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0744f22..f8195e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,8 @@ jobs:
       - name: Bootstrap patched pip trust
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
-        run: python -m pip install PyYAML==6.0.2
+        run: >-
+          python -m pip install --only-binary :all: PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
         run: >-
           python .central-action-policy/scripts/qualification_policy.py validate
@@ -191,7 +192,8 @@ jobs:
         uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
         with:
           clients: pip,python
-      - run: pip install build twine
+      - run: >-
+          pip install --only-binary :all: build==1.6.1 twine==7.0.0
       - run: python -m build
       - name: Compare built release metadata with the exact source commit
         run: python scripts/check_release_metadata.py --source-ref "$(git rev-parse HEAD)" --dist dist
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 43c9b71..93e6e51 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -113,7 +113,8 @@ jobs:
           clients: pip,python
 
       - name: Install build tools
-        run: pip install build twine
+        run: >-
+          pip install --only-binary :all: build==1.6.1 twine==7.0.0
 
       - name: Build package
         run: python -m build