diff --git a/ci/pip-install b/ci/pip-install
index edc1354a804a..ed67ca540d0c 100755
--- a/ci/pip-install
+++ b/ci/pip-install
@@ -17,7 +17,9 @@ else
     if [ "${1:-latest}" = mypy ] ; then
       uv pip install --system -e ".[all,mysql,ci,mypy,test]"
     else
-      uv pip install --system -e ".[all,mysql,ci,test]"
+      # TODO: lxml can use wheels once xmlsec has one
+      # see https://github.com/xmlsec/python-xmlsec/issues/327
+      uv pip install --system --no-binary=lxml  -e ".[all,mysql,ci,test]"
     fi
     if [ "${1:-latest}" = edge ] ; then
         uv pip install --system --upgrade -e ".[all,mysql,test,ci]"