diff --git a/.ci/requirements.in b/.ci/requirements.in
index 939fa15..a4202d4 100644
--- a/.ci/requirements.in
+++ b/.ci/requirements.in
@@ -2,3 +2,4 @@
 meson==1.2.3
 gcovr==5.0
 ninja
+setuptools # https://github.com/harfbuzz/harfbuzz/issues/4475
diff --git a/.ci/requirements.txt b/.ci/requirements.txt
index a61009b..557b5a0 100644
--- a/.ci/requirements.txt
+++ b/.ci/requirements.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
-#    pip-compile --generate-hashes --output-file=.ci/requirements.txt .ci/requirements.in
+#    pip-compile --allow-unsafe --generate-hashes --output-file=.ci/requirements.txt .ci/requirements.in
 #
 fonttools==4.43.1 \
     --hash=sha256:10003ebd81fec0192c889e63a9c8c63f88c7d72ae0460b7ba0cd2a1db246e5ad \
@@ -237,3 +237,9 @@
     --hash=sha256:13fc09fa63bc8d8671a6d247e1eb303c4b343eaee81d861f3404db2935653692 \
     --hash=sha256:1daff0494820c69bc8941e407aa20f577374ee88364ee10a98fdbe0aece96e29
     # via gcovr
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==68.2.2 \
+    --hash=sha256:4ac1475276d2f1c48684874089fefcd83bd7162ddaafb81fac866ba0db282a87 \
+    --hash=sha256:b454a35605876da60632df1a60f736524eb73cc47bbc9f3f1ef1b644de74fd2a
+    # via -r .ci/requirements.in