diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index c25d2f6..7c72534 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -19,7 +19,9 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.x"
+          # Pinned rather than "3.x" for the same reason as pytest.yml: this
+          # job also runs `pipenv install --dev` against Pipfile.lock.
+          python-version: "3.13"
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 7484890..171dd4e 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -16,7 +16,10 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.x"
+        # Pinned rather than "3.x": Pipfile.lock pins scipy==1.15.3, which
+        # publishes wheels only up to cp313. On a newer interpreter pip falls
+        # back to the sdist, which needs OpenBLAS and fails on ubuntu-latest.
+        python-version: "3.13"
     - name: Install dependencies
       run: |
         make setup-dev