diff --git a/tests.sh b/tests.sh
index c1627dc..e89fd7e 100755
--- a/tests.sh
+++ b/tests.sh
@@ -268,27 +268,50 @@ ensure_puppet_repo() {
   DNF_UPDATED=
 }
 
+mig5_rpm_releasever() {
+  if [[ -n "${ENROLL_TEST_MIG5_RPM_RELEASEVER:-}" ]]; then
+    printf '%s' "${ENROLL_TEST_MIG5_RPM_RELEASEVER}"
+    return
+  fi
+
+  if [[ "$(os_id)" == "fedora" ]]; then
+    os_version_major
+    return
+  fi
+
+  # mig5 currently publishes Fedora RPM repositories only.  For RPM-family
+  # CI hosts such as AlmaLinux, use a Fedora repository explicitly instead of
+  # letting dnf expand $releasever to Alma's major version, e.g. 9.
+  printf '43'
+}
+
 ensure_mig5_rpm_repo() {
   if ! is_rpm_family; then
     return
   fi
-  if [[ -e /etc/yum.repos.d/mig5.repo ]]; then
+
+  local repo_file
+  local releasever
+  repo_file=/etc/yum.repos.d/mig5.repo
+  releasever="$(mig5_rpm_releasever)"
+
+  if [[ -e "${repo_file}" ]] && grep -Fq "baseurl=https://rpm.mig5.net/${releasever}/rpm/" "${repo_file}"; then
     return
   fi
+
   section "Setup: mig5 dnf repository"
   pkg_install ca-certificates curl
   run rpm --import https://mig5.net/static/mig5.asc
-  cat >/etc/yum.repos.d/mig5.repo <<'EOF'
+  cat >"${repo_file}" <<EOF
 [mig5]
-name=mig5 Repository
-baseurl=https://rpm.mig5.net/$releasever/rpm/$basearch
+name=mig5 Repository (Fedora ${releasever} packages)
+baseurl=https://rpm.mig5.net/${releasever}/rpm/\$basearch
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
 gpgkey=https://mig5.net/static/mig5.asc
 EOF
-  run dnf -y upgrade --refresh
-  DNF_UPDATED=1
+  DNF_UPDATED=
 }
 
 ensure_jinjaturtle() {