diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 3490273f..4b426c99 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -31,12 +31,23 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@v4
+      - name: Set up Python
+        # Pin the interpreter instead of inheriting the runner image's default.
+        # requirements.txt is hash-pinned and was compiled on 3.14; on an older
+        # Python, alembic additionally requires tomli, which has no hash in the
+        # lock file and pip then refuses the whole install.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python3 --version
           python3 -m venv .venv
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -r requirements.txt
+          # pytest lives in requirements-dev.txt, not requirements.txt. Without
+          # this the test step dies with "No module named pytest".
+          .venv/bin/pip install -r requirements-dev.txt
       - name: Run backend tests
         run: .venv/bin/python -m pytest
 
@@ -83,15 +94,31 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@v4
+      - name: Set up Python
+        # Pin the interpreter instead of inheriting the runner image's default.
+        # requirements.txt is hash-pinned and was compiled on 3.14; on an older
+        # Python, alembic additionally requires tomli, which has no hash in the
+        # lock file and pip then refuses the whole install.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
       - name: Install dependencies
         run: |
           python3 -m venv .venv
           .venv/bin/pip install --upgrade pip
           .venv/bin/pip install -r requirements.txt
       - name: Force utf8mb4 on the CI database
+        # Uses pymysql, already a runtime dependency, rather than the mysql CLI,
+        # which is not present in every runner image.
         run: |
-          mysql -h 127.0.0.1 -uroot -proot -e \
-            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+          .venv/bin/python - <<'PY'
+          import pymysql
+          c = pymysql.connect(host="127.0.0.1", port=3306, user="root", password="root")
+          with c.cursor() as cur:
+              cur.execute("ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 "
+                          "COLLATE utf8mb4_unicode_ci")
+          c.close()
+          PY
       - name: Fresh core upgrade from empty
         run: .venv/bin/flask db upgrade
       - name: Install every bundled plugin (runs its chain)