diff --git a/.github/constraints.txt b/.github/constraints.txt
new file mode 100644
index 000000000..55c1be3e5
--- /dev/null
+++ b/.github/constraints.txt
@@ -0,0 +1,3 @@
+# Temporary CI workaround until Windows ARM64 wheels return.
+# https://github.com/pyca/cryptography/pull/15350
+cryptography==46.0.3; sys_platform == "win32" and platform_machine == "ARM64"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 14a945121..1e725ec1b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,6 +6,8 @@ permissions:
 env:
   # Preserve Unicode in captured CLI output on Windows.
   PYTHONUTF8: "1"
+  PIP_CONSTRAINT: ${{ github.workspace }}/.github/constraints.txt
+  UV_CONSTRAINT: ${{ github.workspace }}/.github/constraints.txt
 
 jobs:
   tests: