diff --git a/.github/workflows/test_and_build.yml b/.github/workflows/test_and_build.yml
index f8fce960..71626010 100644
--- a/.github/workflows/test_and_build.yml
+++ b/.github/workflows/test_and_build.yml
@@ -7,6 +7,13 @@ on:
 
 name: Test 👨‍🔧
 
+env:
+  # CI only, for `composer update` of the cloned core (develop and PRs): Composer blocks these versions for security advisories. Remove after the symfony/yaml and guzzlehttp/psr7 upgrade.
+  ADVISORY_IGNORE: >-
+    {"symfony/yaml": {"constraint": "4.4.*", "reason": "pinned by core and behat/behat 3.8.1", "on-audit": false},
+    "guzzlehttp/psr7": {"constraint": "1.9.*", "reason": "required by acmephp/core 1.3.0", "on-audit": false},
+    "guzzlehttp/guzzle": {"constraint": "7.8.*", "reason": "last guzzle 7 line that accepts guzzlehttp/psr7 1.x", "on-audit": false}}
+
 jobs:
 
   test: #----------------------------------------------------------------------
@@ -69,6 +76,7 @@ jobs:
             composer install --prefer-dist --no-progress --no-interaction
         else
             sed -i 's/\(easyengine\/.*\):\ \".*\"/\1:\ \"dev-develop\"/' composer.json
+            composer config --json --merge policy.advisories.ignore "$ADVISORY_IGNORE"
             composer update --prefer-dist --no-progress --no-interaction
         fi
         composer dump-autoload --no-dev