diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6f218c8..fb3a6f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
   push:
   pull_request:
 
+env:
+  PYTHON_VERSION: '3.11'
+
 jobs:
   test-native:
     runs-on: ${{matrix.os}}
@@ -21,6 +24,11 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: ${{matrix.node-version}}
+      # npm<10.2.3 ships a version of node-gyp that doesn't support Python>3.11.
+      - name: Set up Python ${{env.PYTHON_VERSION}}
+        uses: actions/setup-python@4
+        with:
+          python-version: ${{env.PYTHON_VERSION}}
       - name: Build
         run: npm install --pqclean-backend=native
       - name: Test
@@ -140,6 +148,11 @@ jobs:
         with:
           name: wasm-gen
           path: wasm/gen
+      # npm<10.2.3 ships a version of node-gyp that doesn't support Python>3.11.
+      - name: Set up Python ${{env.PYTHON_VERSION}}
+        uses: actions/setup-python@4
+        with:
+          python-version: ${{env.PYTHON_VERSION}}
       - name: Install
         run: npm install --pqclean-backend=all-algorithms
       - name: Test