diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0abf611e21..6bfcfabe17 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -268,11 +268,8 @@ jobs:
               autoconf \
               automake \
               libtool \
-              nasm
-
-      # Workaround for missing distutils on macOS: https://github.com/actions/runner/issues/2958
-      - name: Install setuptools
-        run: sudo -H pip3 install setuptools
+              nasm \
+              python-setuptools
 
       - name: Setup NuGet
         run: |
diff --git a/vcpkg.json b/vcpkg.json
index 3b99d98bee..f3d06c5d46 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -41,6 +41,11 @@
         "name": "physx",
         "version": "4.1.2#6",
         "$comment": "Upstream vcpkg updated to PhysX 5, which drops support for several target platforms. Stick with 4.1.2 for now."
+      },
+      {
+        "name": "liblzma",
+        "version": "5.4.4",
+        "$comment": "liblzma & xz were compromised upstream: CVE-2024-3094."
       }
     ],
     "features": {