diff --git a/.gitea/workflows/playwright.yml b/.gitea/workflows/playwright.yml
index bc768c3..3dd590c 100644
--- a/.gitea/workflows/playwright.yml
+++ b/.gitea/workflows/playwright.yml
@@ -67,14 +67,16 @@ jobs:
         if: steps.changes.outputs.changed == 'true'
         run: |
           set -euo pipefail
-          export PATH="${HOME}/.local/bin:${HOME}/.bun/bin:${PATH}"
+          export PATH="${HOME}/.bun/bin:${PATH}"
           export UV_PYTHON_DOWNLOADS=automatic
 
           sudo apt-get update -qq
-          sudo apt-get install -y python3 python3-pip python3-venv curl unzip ca-certificates
+          sudo apt-get install -y python3 python3-venv curl unzip ca-certificates
 
-          python3 -m pip install --user --upgrade pip
-          python3 -m pip install --user "uv>=0.4"
+          python3 -m venv /tmp/gitea-ci-venv
+          /tmp/gitea-ci-venv/bin/pip install --upgrade pip
+          /tmp/gitea-ci-venv/bin/pip install "uv>=0.4"
+          export PATH="/tmp/gitea-ci-venv/bin:${PATH}"
 
           # Official Bun installer (not GitHub Actions)
           curl -fsSL https://bun.sh/install | bash
@@ -83,7 +85,7 @@ jobs:
         if: steps.changes.outputs.changed == 'true'
         run: |
           set -euo pipefail
-          export PATH="${HOME}/.local/bin:${HOME}/.bun/bin:${PATH}"
+          export PATH="/tmp/gitea-ci-venv/bin:${HOME}/.bun/bin:${PATH}"
           export BUN_INSTALL="${HOME}/.bun"
 
           (cd backend && uv sync)
diff --git a/.gitea/workflows/test-backend.yml b/.gitea/workflows/test-backend.yml
index 449b37b..9f7476c 100644
--- a/.gitea/workflows/test-backend.yml
+++ b/.gitea/workflows/test-backend.yml
@@ -17,17 +17,19 @@ jobs:
       - name: Checkout and run backend tests
         run: |
           set -euo pipefail
-          export PATH="${HOME}/.local/bin:${PATH}"
           export UV_PYTHON_DOWNLOADS=automatic
 
           git clone "http://172.17.0.1:3000/${{ github.repository }}.git" .
           git checkout "${{ github.sha }}"
 
           sudo apt-get update -qq
-          sudo apt-get install -y python3 python3-pip python3-venv ca-certificates
+          sudo apt-get install -y python3 python3-venv ca-certificates
 
-          python3 -m pip install --user --upgrade pip
-          python3 -m pip install --user "uv>=0.4"
+          # PEP 668: do not pip install into system Python; bootstrap uv inside a throwaway venv
+          python3 -m venv /tmp/gitea-ci-venv
+          /tmp/gitea-ci-venv/bin/pip install --upgrade pip
+          /tmp/gitea-ci-venv/bin/pip install "uv>=0.4"
+          export PATH="/tmp/gitea-ci-venv/bin:${PATH}"
 
           docker compose down -v --remove-orphans || true
           docker compose up -d db mailcatcher