diff --git a/.github/workflows/core.yml b/.github/workflows/core.yml
index 6736a8df7e..4d6374796a 100644
--- a/.github/workflows/core.yml
+++ b/.github/workflows/core.yml
@@ -182,6 +182,7 @@ jobs:
 
           : # Fix for petsc4py+slepc4py build
           echo 'setuptools<81' > constraints.txt
+          echo 'Cython>=3.0,<3.2.4' >> constraints.txt
           export PIP_CONSTRAINT=constraints.txt
 
           if [ ${{ inputs.target_branch }} = 'release' ]; then
diff --git a/pyproject.toml b/pyproject.toml
index 1f3a7f92cc..a3a3841e02 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -23,7 +23,7 @@ dependencies = [
   # TODO RELEASE
   "fenics-ufl @ git+https://github.com/FEniCS/ufl.git@main",
   # TODO RELEASE
-  "firedrake-fiat @ git+https://github.com/firedrakeproject/fiat.git@main",
+  "firedrake-fiat @ git+https://github.com/firedrakeproject/fiat.git@pbrubeck/bubble-lagrange",
   "h5py>3.12.1",
   "immutabledict",
   "libsupermesh",
@@ -153,7 +153,7 @@ docker = [  # Used in firedrake-vanilla container
 
 [build-system]
 requires = [
-  "Cython>=3.0",
+  "Cython>=3.0,<3.2.4",
   "libsupermesh",
   "mpi4py>3; python_version >= '3.13'",
   "mpi4py; python_version < '3.13'",
diff --git a/requirements-build.txt b/requirements-build.txt
index 716b5e0651..11180f77f1 100644
--- a/requirements-build.txt
+++ b/requirements-build.txt
@@ -1,5 +1,5 @@
 # Core build dependencies (adapted from pyproject.toml)
-Cython>=3.0
+Cython>=3.0,<3.2.4
 libsupermesh
 mpi4py>3; python_version >= '3.13'
 mpi4py; python_version < '3.13'