diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index bd5b520..8bb0def 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -34,30 +34,18 @@ jobs:
       - name: Install Python and uv
         run: |
           set -euo pipefail
-          if command -v python3.11 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3.11
-          elif command -v python3 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3
-          else
-            echo "python3 is not available on the runner" >&2
-            exit 1
-          fi
-
-          timeout 180s "${BOOTSTRAP_PYTHON}" -m pip install --user --break-system-packages --upgrade pip uv
-          export PATH="$HOME/.local/bin:$PATH"
           PROJECT_PYTHON_VERSION="$(cat .python-version 2>/dev/null || printf '%s' "${PYTHON_VERSION}")"
-          timeout 300s uv python install "${PROJECT_PYTHON_VERSION}"
-          PYTHON_BIN="$(uv python find --managed-python "${PROJECT_PYTHON_VERSION}")"
+          PYTHON_BIN="$(./scripts/ensure-ci-python.sh "${PROJECT_PYTHON_VERSION}")"
 
           printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env
 
       - name: Create virtual environment and install dependencies
         run: |
           set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
           . ./.ci-python-env
-          uv venv --python "${PYTHON_BIN}"
+          "${PYTHON_BIN}" -m venv .venv
           . .venv/bin/activate
+          python -m pip install --upgrade pip uv
           uv sync --dev --frozen
 
       - name: Run Ruff linting
@@ -121,30 +109,18 @@ jobs:
       - name: Install Python and uv
         run: |
           set -euo pipefail
-          if command -v python3.11 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3.11
-          elif command -v python3 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3
-          else
-            echo "python3 is not available on the runner" >&2
-            exit 1
-          fi
-
-          timeout 180s "${BOOTSTRAP_PYTHON}" -m pip install --user --break-system-packages --upgrade pip uv
-          export PATH="$HOME/.local/bin:$PATH"
           PROJECT_PYTHON_VERSION="$(cat .python-version 2>/dev/null || printf '%s' "${PYTHON_VERSION}")"
-          timeout 300s uv python install "${PROJECT_PYTHON_VERSION}"
-          PYTHON_BIN="$(uv python find --managed-python "${PROJECT_PYTHON_VERSION}")"
+          PYTHON_BIN="$(./scripts/ensure-ci-python.sh "${PROJECT_PYTHON_VERSION}")"
 
           printf 'PYTHON_BIN=%s\n' "${PYTHON_BIN}" > .ci-python-env
 
       - name: Create virtual environment and install dependencies
         run: |
           set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
           . ./.ci-python-env
-          uv venv --python "${PYTHON_BIN}"
+          "${PYTHON_BIN}" -m venv .venv
           . .venv/bin/activate
+          python -m pip install --upgrade pip uv
           uv sync --dev --frozen
 
       - name: Run regular pytest suite
@@ -233,22 +209,11 @@ jobs:
           fi
           tar -xzf "${ARCHIVE_PATH}"
 
-      - name: Install Python and uv for artifact environment
+      - name: Install Python for artifact environment
         run: |
           set -euo pipefail
-          if command -v python3.11 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3.11
-          elif command -v python3 >/dev/null 2>&1; then
-            BOOTSTRAP_PYTHON=python3
-          else
-            echo "python3 is not available on the runner" >&2
-            exit 1
-          fi
-
-          timeout 180s "${BOOTSTRAP_PYTHON}" -m pip install --user --break-system-packages --upgrade pip uv
-          export PATH="$HOME/.local/bin:$PATH"
           PROJECT_PYTHON_VERSION="$(cat .python-version 2>/dev/null || printf '%s' "${PYTHON_VERSION}")"
-          timeout 300s uv python install "${PROJECT_PYTHON_VERSION}"
+          ./scripts/ensure-ci-python.sh "${PROJECT_PYTHON_VERSION}" >/dev/null
 
       - name: Run API inventory pytest suite
         env:
diff --git a/scripts/ensure-ci-python.sh b/scripts/ensure-ci-python.sh
new file mode 100755
index 0000000..b85a35b
--- /dev/null
+++ b/scripts/ensure-ci-python.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+TARGET_VERSION="${1:-3.11}"
+IFS="." read -r PYTHON_MAJOR PYTHON_MINOR _ <<< "${TARGET_VERSION}"
+
+if [[ -n "${PYTHON_MINOR:-}" ]]; then
+  PYTHON_BIN="python${PYTHON_MAJOR}.${PYTHON_MINOR}"
+else
+  PYTHON_BIN="python${PYTHON_MAJOR}"
+fi
+
+if command -v "${PYTHON_BIN}" >/dev/null 2>&1; then
+  command -v "${PYTHON_BIN}"
+  exit 0
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get update
+apt-get install -y software-properties-common
+add-apt-repository -y ppa:deadsnakes/ppa
+apt-get update
+apt-get install -y "${PYTHON_BIN}" "${PYTHON_BIN}-venv"
+
+command -v "${PYTHON_BIN}"