diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 74b403b..22fd204 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -93,7 +93,8 @@ jobs:
       - name: Bootstrap pip (no apt — act runner hits bullseye GPG errors)
         run: |
           python3 --version
-          curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
+          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
           python3 /tmp/get-pip.py --disable-pip-version-check
           python3 -m pip --version
 
@@ -193,7 +194,8 @@ jobs:
       - name: Scan Python dependencies
         run: |
           if [ -f requirements.txt ]; then
-            curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
+            PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+            curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
             python3 /tmp/get-pip.py --disable-pip-version-check
             python3 -m pip install --no-cache-dir pip-audit
             python3 -m pip-audit -r requirements.txt
@@ -215,7 +217,8 @@ jobs:
       - name: Bootstrap pip (no apt)
         run: |
           python3 --version
-          curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
+          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
           python3 /tmp/get-pip.py --disable-pip-version-check
 
       - name: Install Semgrep
@@ -261,7 +264,8 @@ jobs:
       - name: Bootstrap pip (no apt)
         run: |
           python3 --version
-          curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
+          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
           python3 /tmp/get-pip.py --disable-pip-version-check
 
       - name: Install Ansible
@@ -311,7 +315,8 @@ jobs:
       - name: Bootstrap pip (no apt)
         run: |
           python3 --version
-          curl -fsSL https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
+          PY=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
+          curl -fsSL "https://bootstrap.pypa.io/pip/${PY}/get-pip.py" -o /tmp/get-pip.py
           python3 /tmp/get-pip.py --disable-pip-version-check
 
       - name: Configure CI Ansible (no vault, localhost inventory)