diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index af83c01475..25c88b3ab4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -164,7 +164,7 @@ jobs:
             container-options: --security-opt seccomp=unconfined
             pre-checkout-setup: |
               apt-get update
-              apt-get install -y git
+              apt-get install -y git ca-certificates
             extra-packages: >-
               libssl-dev
             configure-options: >-
diff --git a/ci/gh-install.sh b/ci/gh-install.sh
index 76afbb676c..da9f8c36bf 100755
--- a/ci/gh-install.sh
+++ b/ci/gh-install.sh
@@ -80,7 +80,6 @@ case "$ID" in
             e2fslibs-dev
             elfutils
             fsverity
-            fuse
             gnupg
             gobject-introspection
             gtk-doc-tools
@@ -89,7 +88,6 @@ case "$ID" in
             libavahi-client-dev
             libavahi-glib-dev
             libcap-dev
-            libfuse-dev
             libgirepository1.0-dev
             libglib2.0-dev
             libglib2.0-doc
@@ -144,6 +142,14 @@ case "$ID" in
                 ;;
         esac
 
+        # libfuse-dev (FUSE 2) has been removed from Debian Testing.
+        # Only install it on older versions that still provide it.
+        case "${VERSION_CODENAME:-}" in
+            (buster|bullseye|bookworm|focal|jammy|bionic)
+                PACKAGES+=(fuse libfuse-dev)
+                ;;
+        esac
+
         apt-get -y update
         apt-get -y install "${PACKAGES[@]}" "$@"
         ;;