diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml
index 5796c62..ebcc271 100644
--- a/.gitea/workflows/lint.yml
+++ b/.gitea/workflows/lint.yml
@@ -60,9 +60,11 @@ jobs:
           # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
           curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
             | tar -xz -C /opt
-          # Install pip-audit + the bot's requirements into the same env.
+          # Upgrade pip+setuptools first (standalone build ships old versions with CVEs),
+          # then install pip-audit + the bot's requirements into the same env.
           # Using --local avoids pip-audit creating an internal venv (which fails
           # with ensurepip exit 127 on this standalone build).
+          /opt/python/bin/pip install --upgrade pip setuptools
           /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
 
       - name: Audit matrixbot dependencies