diff --git a/.github/workflows/build-vesin.yml b/.github/workflows/build-vesin.yml
index a5129fb43ea..50ba67c31d5 100644
--- a/.github/workflows/build-vesin.yml
+++ b/.github/workflows/build-vesin.yml
@@ -63,7 +63,10 @@ jobs:
           CIBW_BUILD_FRONTEND: build
           CIBW_ENVIRONMENT: >-
             PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
-            PIP_ONLY_BINARY=cmake
+            PIP_ONLY_BINARY=cmake,numpy,scipy,matplotlib
+          # ase (a test-only dep) pulls in numpy/scipy/matplotlib; without pinning
+          # them to our registry's riscv64 wheels too, pip can resolve a newer
+          # PyPI-only release of one and fall back to a from-source build (gotcha 291).
           CIBW_TEST_REQUIRES: pytest pytest-timeout ase
           # {project} is the checkout root, not package-dir, since python/vesin's CMakeLists.txt
           # needs the sibling top-level vesin/ (C++ library) directory.