diff --git a/package-lock.json b/package-lock.json
index 25484ac..abe1336 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2359,7 +2359,7 @@
       "devDependencies": {
         "@types/node": "22.10.2",
         "typescript": "5.6.3",
-        "vitest": "^4.1.5"
+        "vitest": "4.1.5"
       }
     },
     "packages/extension": {
diff --git a/packages/core/tests/kdf.test.ts b/packages/core/tests/kdf.test.ts
index b4a2d59..daef7a5 100644
--- a/packages/core/tests/kdf.test.ts
+++ b/packages/core/tests/kdf.test.ts
@@ -12,7 +12,7 @@ const fastParams: KdfParams = {
   parallelism: 1,
 };
 
-describe("KDF", () => {
+describe("KDF", { timeout: 30_000 }, () => {
   it("derives a 32-byte master key", async () => {
     const key = await deriveMasterKey("correct-horse-battery-staple", fastParams);
     expect(key).toBeInstanceOf(Uint8Array);
@@ -63,4 +63,4 @@ describe("KDF", () => {
     const k2 = await deriveAuthKey(masterKey, "different-password");
     expect(k1).not.toBe(k2);
   });
-}, { timeout: 30_000 });
+});
diff --git a/server/pyproject.toml b/server/pyproject.toml
index b15c4cf..c0adc39 100644
--- a/server/pyproject.toml
+++ b/server/pyproject.toml
@@ -28,7 +28,9 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "pytest==9.0.3",
-    "pytest-asyncio==0.24.0",
+    # pytest-asyncio 0.24 capped at pytest<8.4; 1.x is the first line that
+    # supports pytest 9.
+    "pytest-asyncio==1.3.0",
     "pytest-cov==6.0.0",
     "httpx==0.28.1",
     "aiosqlite==0.20.0",