diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index cc730d4..2d0e27f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -134,7 +134,12 @@ jobs:
 
       - name: Install Node.js dependencies
         if: ${{ matrix.needs_node && steps.node-cache.outputs.cache-hit != 'true' }}
-        run: npm ci
+        # --ignore-scripts keeps lifecycle scripts in the dependency tree from
+        # running. copy-assets is our own postinstall step and is what vendors
+        # static/vendor/, so it has to be invoked explicitly instead.
+        run: |
+          npm ci --ignore-scripts
+          npm run copy-assets
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -148,8 +153,8 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-test.txt
+          pip install --only-binary :all: -r requirements.txt
+          pip install --only-binary :all: -r requirements-test.txt
 
       - name: Cache Playwright browsers
         if: ${{ matrix.needs_playwright }}
@@ -577,7 +582,12 @@ jobs:
 
       - name: Install Node.js dependencies
         if: ${{ matrix.needs_node && steps.node-cache.outputs.cache-hit != 'true' }}
-        run: npm ci
+        # --ignore-scripts keeps lifecycle scripts in the dependency tree from
+        # running. copy-assets is our own postinstall step and is what vendors
+        # static/vendor/, so it has to be invoked explicitly instead.
+        run: |
+          npm ci --ignore-scripts
+          npm run copy-assets
 
       - name: Set up Python
         uses: actions/setup-python@v7
@@ -591,8 +601,8 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements.txt
-          pip install -r requirements-test.txt
+          pip install --only-binary :all: -r requirements.txt
+          pip install --only-binary :all: -r requirements-test.txt
 
       - name: Cache Playwright browsers
         if: ${{ matrix.needs_playwright }}