diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml
index 2a5d14c..b61e146 100644
--- a/.gitea/workflows/test.yml
+++ b/.gitea/workflows/test.yml
@@ -21,7 +21,27 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install test tooling
-        run: python3 -m pip install --quiet pytest pytest-asyncio ruff androidtvremote2
+        run: |
+          set -euo pipefail
+          # Try the plain install first: it succeeds on images whose Python is
+          # not externally managed (and on pip < 23, which has no PEP 668
+          # enforcement at all). When the runner image DOES mark its Python as
+          # externally managed — Debian/Ubuntu based Gitea act images do — pip
+          # refuses with externally-managed-environment and we retry with the
+          # sanctioned override. That override is safe here specifically
+          # because the job runs in a disposable container, and because the
+          # flag only exists on pip >= 23.0.1, the same version that raises
+          # the refusal in the first place.
+          #
+          # Tools are pinned to the versions the suite was validated against so
+          # a newer ruff rule set cannot redden the gate on unrelated commits;
+          # androidtvremote2 tracks the manifest floor so CI exercises the same
+          # dependency users install.
+          PKGS="pytest~=9.1 pytest-asyncio~=1.4 ruff~=0.17.0 'androidtvremote2>=0.2.0'"
+          if ! eval python3 -m pip install --quiet $PKGS; then
+            echo "system Python is externally managed; retrying with --break-system-packages"
+            eval python3 -m pip install --quiet --break-system-packages $PKGS
+          fi
 
       - name: Lint
         run: ruff check custom_components tests