diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 29ccc9f9..e4cb5e4a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -420,7 +420,10 @@ jobs:
                                              cryptography
                "${PYTHON}" -m pip install --force-reinstall --no-deps cryptography*.whl
              fi
-             "${PYTHON}" -m pip install --upgrade -r requirements.txt ${PIP_ARGS}
+             # build constraints file to prevent downgrades of existing
+             # packages
+             "${PYTHON}" -m pip freeze | grep == | sed 's/==/>=/' > constraints.txt
+             "${PYTHON}" -m pip install --upgrade -c constraints.txt -r requirements.txt ${PIP_ARGS}
              "${PYTHON}" -m pip list
 
       - name: Install PyInstaller