diff --git a/internal/recipe/pip.go b/internal/recipe/pip.go
index 9f333fa..5f936f9 100644
--- a/internal/recipe/pip.go
+++ b/internal/recipe/pip.go
@@ -47,8 +47,8 @@ func (p *PipRecipe) Build(ctx context.Context, s *stack.Stack, src *source.Input
 		},
 		ExtraDeps: []string{
 			"setuptools",
-			"wheel>=0.46.2", // CVE-2026-24049
-			"flit-core>=3.11", // build backend required by pip 26.x (downloaded as wheel to avoid circular dep)
+			"wheel>=0.46.2",      // CVE-2026-24049
+			"flit-core>=3.11,<4", // build backend required by pip 26.x (must be <4 per pip's pyproject.toml)
 		},
 	}).Build(ctx, s, src, r, out)
 }