diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9118b59..a914e30 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -75,16 +75,13 @@ jobs:
           python-version: '3.13'
           cache: pip
       - run: pip install -r requirements.txt
-      - name: Prime the CI database (utf8mb4 + native auth for pymysql)
-        # MySQL 8 defaults root to caching_sha2_password, which pymysql can
-        # only speak with the 'cryptography' package. Rather than add that
-        # dependency (and its offline wheel), switch root to native auth here
-        # via the mysql CLI, so the app's pymysql connections work as-is.
+      - name: Force utf8mb4 on the CI database
+        # pymysql speaks MySQL 8's caching_sha2_password via the cryptography
+        # package (a requirements.txt dependency), so no auth-plugin change
+        # is needed here.
         run: |
           mysql -h 127.0.0.1 -uroot -proot -e \
-            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; \
-             ALTER USER 'root'@'%' IDENTIFIED WITH mysql_native_password BY 'root'; \
-             FLUSH PRIVILEGES;"
+            "ALTER DATABASE shopdb_ci CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
       - name: Fresh core upgrade from empty
         run: flask db upgrade
       - name: Install every bundled plugin (runs its chain)
diff --git a/requirements.in b/requirements.in
index 87eb7d1..46c7c3b 100644
--- a/requirements.in
+++ b/requirements.in
@@ -11,6 +11,7 @@ marshmallow-sqlalchemy>=0.29
 # Database
 mysql-connector-python>=8.0
 pymysql>=1.1
+cryptography>=42.0   # pymysql needs it for MySQL 8 caching_sha2_password auth
 
 # CLI and utilities
 click>=8.1
diff --git a/requirements.txt b/requirements.txt
index d48e166..78ec85c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -83,6 +83,7 @@ pygments==2.20.0
 pyjwt==2.12.1
     # via flask-jwt-extended
 pymysql==1.1.3
+cryptography>=42.0
     # via -r requirements.in
 pytest==9.0.3
     # via