diff --git a/Makefile b/Makefile
index a615839b81..b0d84151c0 100644
--- a/Makefile
+++ b/Makefile
@@ -111,7 +111,7 @@ upgrade: requirements check_pins ## update the requirements/*.txt files with the
 	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url -o requirements/doc.txt requirements/doc.in
 	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url -o requirements/test.txt requirements/test.in
 	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url -o requirements/dev.txt requirements/dev.in
-	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url -o requirements/ci.txt requirements/ci.in
+	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url --allow-unsafe -o requirements/ci.txt requirements/ci.in
 	$(PIP_COMPILE) --no-emit-trusted-host --no-emit-index-url -o requirements/js_test.txt requirements/js_test.in
 	# This section removes django from test.txt to
 	# let tox control the Django version for tests
diff --git a/requirements/ci.in b/requirements/ci.in
index ffbaa2043b..ff2566be5a 100644
--- a/requirements/ci.in
+++ b/requirements/ci.in
@@ -3,3 +3,4 @@
 -c constraints.txt
 
 tox                       # Virtualenv management for tests
+setuptools
diff --git a/requirements/ci.txt b/requirements/ci.txt
index c7cfe38210..1560e62423 100644
--- a/requirements/ci.txt
+++ b/requirements/ci.txt
@@ -28,3 +28,7 @@ tox==3.28.0
     #   -r requirements/ci.in
 virtualenv==20.25.3
     # via tox
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==69.5.1
+    # via -r requirements/ci.in