diff --git a/.github/actions/run-cluster-init/action.yaml b/.github/actions/run-cluster-init/action.yaml
index 8b62038a1..988903df9 100644
--- a/.github/actions/run-cluster-init/action.yaml
+++ b/.github/actions/run-cluster-init/action.yaml
@@ -34,12 +34,21 @@ runs:
       uses: AbsaOSS/k3d-action@v2.3.0
       with:
         cluster-name: ${{ inputs.cluster_name }}
+        # k3d-action's default (v5.4.1) is missing its checksums.txt release
+        # asset, which the k3d install script requires, so pin an explicit
+        # version whose release assets are complete.
+        k3d-version: v5.5.0
+        # k3d v5.5.0 defaults to k3s v1.26.4-k3s1 (k8s 1.26), which no
+        # longer serves policy/v1beta1 or autoscaling/v2beta1 - APIs that
+        # Istio 1.12.5's install manifests hardcode. Pin the k3s image to
+        # a pre-1.25 k8s version below so that install keeps working.
         args: >-
           --servers 1
           --agents 3
           --port 80:80@agent:*
           --registry-create ${{inputs.local_registry}}
-          --k3s-arg "--no-deploy=traefik,metrics-server@server:*"
+          --k3s-arg "--disable=traefik,metrics-server@server:*"
+          --image rancher/k3s:v1.24.17-k3s1
 
     - name: Publish images to local registry
       env:
diff --git a/infra/cluster-init/Dockerfile b/infra/cluster-init/Dockerfile
index e23113d10..e9c009670 100644
--- a/infra/cluster-init/Dockerfile
+++ b/infra/cluster-init/Dockerfile
@@ -1,8 +1,8 @@
 FROM alpine:3
 
-COPY --from=bitnami/kubectl:1.22.16 /opt/bitnami/kubectl/bin/kubectl /usr/bin/kubectl
-
 WORKDIR /app
-RUN apk add --no-cache curl bash
+RUN apk add --no-cache curl bash && \
+    curl -Lo /usr/bin/kubectl "https://dl.k8s.io/release/v1.22.16/bin/linux/amd64/kubectl" && \
+    chmod +x /usr/bin/kubectl
 
 COPY . .
diff --git a/infra/e2e/turing.values.yaml b/infra/e2e/turing.values.yaml
index 8e012d855..e8a5ed16b 100644
--- a/infra/e2e/turing.values.yaml
+++ b/infra/e2e/turing.values.yaml
@@ -46,6 +46,12 @@ turing:
                 route_name: treatment-a
 
 postgresql: &postgresql
+  # Bitnami stopped retaining versioned tags on docker.io/bitnami/postgresql
+  # (only "latest" remains); the pinned 12.13.0 tag now 404s. The same tags
+  # are still published under bitnamilegacy/postgresql.
+  image:
+    registry: docker.io
+    repository: bitnamilegacy/postgresql
   primary:
     persistence:
       enabled: false
diff --git a/sdk/Makefile b/sdk/Makefile
index fe6971db9..62ec29847 100644
--- a/sdk/Makefile
+++ b/sdk/Makefile
@@ -1,7 +1,10 @@
 .PHONY: setup
 setup:
-	@pip install "setuptools>=64,<75" "wheel"
-	@pip install -r requirements.txt -r requirements.dev.txt
+	# setuptools>=71 calls packaging.utils.canonicalize_version(strip_trailing_zero=...),
+	# an argument mlflow's pinned packaging<22 doesn't support, breaking sdist/egg_info
+	# with "unexpected keyword argument 'strip_trailing_zero'". Cap below 71 to avoid it.
+	@pip install "setuptools>=64,<71" "wheel" "Cython<3" "numpy>=1.26.0,<2"
+	@pip install --no-build-isolation -r requirements.txt -r requirements.dev.txt
 
 .PHONY: gen-client
 gen-client: