diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a74d0efd4d6..1693b5330a5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -42,7 +42,7 @@ before_script:
   - ./tests/scripts/rebase.sh
   - update-alternatives --install /usr/bin/python python /usr/bin/python3 1
   - python -m pip uninstall -y ansible ansible-base ansible-core
-  - python -m pip install -r tests/requirements-${ANSIBLE_MAJOR_VERSION}.txt
+  - PIP_CONSTRAINT=tests/constraints.txt python -m pip install -r tests/requirements-${ANSIBLE_MAJOR_VERSION}.txt
   - mkdir -p /.ssh
 
 .job: &job
diff --git a/.gitlab-ci/lint.yml b/.gitlab-ci/lint.yml
index f063ea08553..45273127a2c 100644
--- a/.gitlab-ci/lint.yml
+++ b/.gitlab-ci/lint.yml
@@ -70,7 +70,7 @@ tox-inventory-builder:
     - apt-get update && apt-get install -y python3-pip
     - update-alternatives --install /usr/bin/python python /usr/bin/python3 10
     - python -m pip uninstall -y ansible ansible-base ansible-core
-    - python -m pip install -r tests/requirements.txt
+    - PIP_CONSTRAINT=tests/constraints.txt python -m pip install -r tests/requirements.txt
   script:
     - pip3 install tox
     - cd contrib/inventory_builder && tox
diff --git a/.gitlab-ci/molecule.yml b/.gitlab-ci/molecule.yml
index 736c0ffd755..2211756df61 100644
--- a/.gitlab-ci/molecule.yml
+++ b/.gitlab-ci/molecule.yml
@@ -12,7 +12,7 @@
     - apt-get update && apt-get install -y python3-pip
     - update-alternatives --install /usr/bin/python python /usr/bin/python3 10
     - python -m pip uninstall -y ansible ansible-base ansible-core
-    - python -m pip install -r tests/requirements.txt
+    - PIP_CONSTRAINT=tests/constraints.txt python -m pip install -r tests/requirements.txt
     - ./tests/scripts/vagrant_clean.sh
   script:
     - ./tests/scripts/molecule_run.sh
diff --git a/.gitlab-ci/vagrant.yml b/.gitlab-ci/vagrant.yml
index 52aec6c78a7..c063e0b1d16 100644
--- a/.gitlab-ci/vagrant.yml
+++ b/.gitlab-ci/vagrant.yml
@@ -16,7 +16,7 @@
     - apt-get update && apt-get install -y python3-pip
     - update-alternatives --install /usr/bin/python python /usr/bin/python3 10
     - python -m pip uninstall -y ansible ansible-base ansible-core
-    - python -m pip install -r tests/requirements.txt
+    - PIP_CONSTRAINT=tests/constraints.txt python -m pip install -r tests/requirements.txt
     - ./tests/scripts/vagrant_clean.sh
   script:
     - ./tests/scripts/testcases_run.sh
diff --git a/pipeline.Dockerfile b/pipeline.Dockerfile
index 91bda14de15..0431f1bc531 100644
--- a/pipeline.Dockerfile
+++ b/pipeline.Dockerfile
@@ -39,10 +39,11 @@ WORKDIR /kubespray
 
 RUN --mount=type=bind,target=./requirements-2.12.txt,src=./requirements-2.12.txt \
     --mount=type=bind,target=./tests/requirements-2.12.txt,src=./tests/requirements-2.12.txt \
+    --mount=type=bind,target=./tests/constraints.txt,src=./tests/constraints.txt \
     --mount=type=bind,target=./roles/kubespray-defaults/defaults/main.yaml,src=./roles/kubespray-defaults/defaults/main.yaml \
     update-alternatives --install /usr/bin/python python /usr/bin/python3 1 \
     && pip install --no-compile --no-cache-dir pip -U \
-    && pip install --no-compile --no-cache-dir -r tests/requirements-2.12.txt \
+    && PIP_CONSTRAINT=tests/constraints.txt pip install --no-compile --no-cache-dir -r tests/requirements-2.12.txt \
     && KUBE_VERSION=$(sed -n 's/^kube_version: //p' roles/kubespray-defaults/defaults/main.yaml) \
     && curl -L https://dl.k8s.io/release/$KUBE_VERSION/bin/linux/$(dpkg --print-architecture)/kubectl -o /usr/local/bin/kubectl \
     && echo $(curl -L https://dl.k8s.io/release/$KUBE_VERSION/bin/linux/$(dpkg --print-architecture)/kubectl.sha256) /usr/local/bin/kubectl | sha256sum --check \
diff --git a/tests/constraints.txt b/tests/constraints.txt
new file mode 100644
index 00000000000..039eb0db279
--- /dev/null
+++ b/tests/constraints.txt
@@ -0,0 +1 @@
+cython<3