diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 9fc6b21..f8ed89d 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
               mkdir -m 755 -p /etc/apt/keyrings
               apt-get update
               DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-                ca-certificates curl gnupg git tar gzip findutils bash nodejs \
+                ca-certificates curl gnupg git tar gzip findutils bash nodejs procps \
                 ansible ansible-lint python3 python3-venv python3-pip pipx systemctl python3-apt jq python3-jsonschema \
                 puppet hiera
               curl -fsSL https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public | gpg --dearmor | tee /etc/apt/keyrings/salt-archive-keyring.pgp > /dev/null
@@ -46,7 +46,7 @@ jobs:
             almalinux)
               dnf -y upgrade --refresh
               dnf -y install \
-                ca-certificates curl-minimal gnupg2 git tar gzip findutils bash which jq nodejs \
+                ca-certificates curl-minimal gnupg2 git tar gzip findutils bash which jq nodejs procps-ng \
                 dnf-plugins-core epel-release
               dnf -y config-manager --set-enabled crb || true
               curl -fsSL https://github.com/saltstack/salt-install-guide/releases/latest/download/salt.repo > /etc/yum.repos.d/salt.repo
diff --git a/tests.sh b/tests.sh
index 4e2b98b..e89fd7e 100755
--- a/tests.sh
+++ b/tests.sh
@@ -90,9 +90,19 @@ require_supported_ci_os() {
 }
 
 
+pid1_comm() {
+  if [[ -r /proc/1/comm ]]; then
+    tr -d '[:space:]' </proc/1/comm || true
+    return
+  fi
+  if command -v ps >/dev/null 2>&1; then
+    ps -p 1 -o comm= 2>/dev/null | tr -d '[:space:]' || true
+  fi
+}
+
 configure_ansible_playbook_extra_args() {
   local pid1
-  pid1="$(ps -p 1 -o comm= 2>/dev/null | tr -d '[:space:]' || true)"
+  pid1="$(pid1_comm)"
 
   ANSIBLE_PLAYBOOK_EXTRA_ARGS=()
   if [[ "${pid1}" != "systemd" ]]; then
@@ -258,27 +268,50 @@ ensure_puppet_repo() {
   DNF_UPDATED=
 }
 
+mig5_rpm_releasever() {
+  if [[ -n "${ENROLL_TEST_MIG5_RPM_RELEASEVER:-}" ]]; then
+    printf '%s' "${ENROLL_TEST_MIG5_RPM_RELEASEVER}"
+    return
+  fi
+
+  if [[ "$(os_id)" == "fedora" ]]; then
+    os_version_major
+    return
+  fi
+
+  # mig5 currently publishes Fedora RPM repositories only.  For RPM-family
+  # CI hosts such as AlmaLinux, use a Fedora repository explicitly instead of
+  # letting dnf expand $releasever to Alma's major version, e.g. 9.
+  printf '43'
+}
+
 ensure_mig5_rpm_repo() {
   if ! is_rpm_family; then
     return
   fi
-  if [[ -e /etc/yum.repos.d/mig5.repo ]]; then
+
+  local repo_file
+  local releasever
+  repo_file=/etc/yum.repos.d/mig5.repo
+  releasever="$(mig5_rpm_releasever)"
+
+  if [[ -e "${repo_file}" ]] && grep -Fq "baseurl=https://rpm.mig5.net/${releasever}/rpm/" "${repo_file}"; then
     return
   fi
+
   section "Setup: mig5 dnf repository"
   pkg_install ca-certificates curl
   run rpm --import https://mig5.net/static/mig5.asc
-  cat >/etc/yum.repos.d/mig5.repo <<'EOF'
+  cat >"${repo_file}" <<EOF
 [mig5]
-name=mig5 Repository
-baseurl=https://rpm.mig5.net/$releasever/rpm/$basearch
+name=mig5 Repository (Fedora ${releasever} packages)
+baseurl=https://rpm.mig5.net/${releasever}/rpm/\$basearch
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1
 gpgkey=https://mig5.net/static/mig5.asc
 EOF
-  run dnf -y upgrade --refresh
-  DNF_UPDATED=1
+  DNF_UPDATED=
 }
 
 ensure_jinjaturtle() {