diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b08d252d..bb9d713a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -170,6 +170,14 @@ jobs:
         with:
           python-version: '3.12'
 
+      # pytest for the CTest rows that run `python -m pytest` (tests/CMakeLists.txt:
+      # test_run_json_selected_window, test_compile_inventory_pipeline), the same
+      # hash-pinned wheels as the preflight job. A failed install fails the job.
+      - name: Install the CTest pytest runner
+        run: |
+          python3 -m pip install --disable-pip-version-check --no-input \
+            --require-hashes --only-binary ':all:' -r scripts/requirements-preflight.txt
+
       # tzdata-legacy carries the backward links test_native_calendar resolves
       # (US/Eastern, Japan, GB); noble split them out of tzdata, and the hosted
       # image happens to have it, so the row stays green on a bare runner too.
@@ -247,6 +255,14 @@ jobs:
         with:
           python-version: '3.12'
 
+      # pytest for the CTest rows that run `python -m pytest` (tests/CMakeLists.txt:
+      # test_run_json_selected_window, test_compile_inventory_pipeline), the same
+      # hash-pinned wheels as the preflight job. A failed install fails the job.
+      - name: Install the CTest pytest runner
+        run: |
+          python3 -m pip install --disable-pip-version-check --no-input \
+            --require-hashes --only-binary ':all:' -r scripts/requirements-preflight.txt
+
       - name: Install dependencies
         run: |
           sudo apt-get update
@@ -298,6 +314,14 @@ jobs:
         with:
           python-version: '3.12'
 
+      # pytest for the CTest rows that run `python -m pytest` (tests/CMakeLists.txt:
+      # test_run_json_selected_window, test_compile_inventory_pipeline), the same
+      # hash-pinned wheels as the preflight job. A failed install fails the job.
+      - name: Install the CTest pytest runner
+        run: |
+          python3 -m pip install --disable-pip-version-check --no-input \
+            --require-hashes --only-binary ':all:' -r scripts/requirements-preflight.txt
+
       - name: Install dependencies
         run: |
           sudo apt-get update
diff --git a/.github/workflows/native-live.yml b/.github/workflows/native-live.yml
index 5b019737..fc213b7c 100644
--- a/.github/workflows/native-live.yml
+++ b/.github/workflows/native-live.yml
@@ -83,6 +83,14 @@ jobs:
         with:
           python-version: '3.12'
 
+      # pytest for the CTest rows that run `python -m pytest` (tests/CMakeLists.txt:
+      # test_run_json_selected_window, test_compile_inventory_pipeline), the same
+      # hash-pinned wheels as the preflight job. A failed install fails the job.
+      - name: Install the CTest pytest runner
+        run: |
+          python3 -m pip install --disable-pip-version-check --no-input \
+            --require-hashes --only-binary ':all:' -r scripts/requirements-preflight.txt
+
       - name: Install native build dependencies
         run: |
           sudo apt-get update