diff --git a/Dockerfile b/Dockerfile
index 32681cbbdfb13..e97b96ad134da 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -493,7 +493,10 @@ function common::get_packaging_tool() {
         echo
         export PACKAGING_TOOL="pip"
         export PACKAGING_TOOL_CMD="pip"
-        export EXTRA_INSTALL_FLAGS="--root-user-action ignore"
+        # --no-binary  is needed in order to avoid libxml and xmlsec using different version of libxml2
+        # (binary lxml embeds its own libxml2, while xmlsec uses system one).
+        # See https://bugs.launchpad.net/lxml/+bug/2110068
+        export EXTRA_INSTALL_FLAGS="--root-user-action ignore --no-binary lxml,xmlsec"
         export EXTRA_UNINSTALL_FLAGS="--yes"
         export UPGRADE_TO_HIGHEST_RESOLUTION="--upgrade --upgrade-strategy eager"
         export UPGRADE_IF_NEEDED="--upgrade --upgrade-strategy only-if-needed"
diff --git a/Dockerfile.ci b/Dockerfile.ci
index 2282881db893c..deee1b6d97cd1 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -432,7 +432,10 @@ function common::get_packaging_tool() {
         echo
         export PACKAGING_TOOL="pip"
         export PACKAGING_TOOL_CMD="pip"
-        export EXTRA_INSTALL_FLAGS="--root-user-action ignore"
+        # --no-binary  is needed in order to avoid libxml and xmlsec using different version of libxml2
+        # (binary lxml embeds its own libxml2, while xmlsec uses system one).
+        # See https://bugs.launchpad.net/lxml/+bug/2110068
+        export EXTRA_INSTALL_FLAGS="--root-user-action ignore --no-binary lxml,xmlsec"
         export EXTRA_UNINSTALL_FLAGS="--yes"
         export UPGRADE_TO_HIGHEST_RESOLUTION="--upgrade --upgrade-strategy eager"
         export UPGRADE_IF_NEEDED="--upgrade --upgrade-strategy only-if-needed"
diff --git a/dev/breeze/README.md b/dev/breeze/README.md
index 596f2c75571c1..e9a18fe9aac24 100644
--- a/dev/breeze/README.md
+++ b/dev/breeze/README.md
@@ -135,6 +135,6 @@ PLEASE DO NOT MODIFY THE HASH BELOW! IT IS AUTOMATICALLY UPDATED BY PRE-COMMIT.
 
 ---------------------------------------------------------------------------------------------------------
 
-Package config hash: 4af1d01a84e38562c43130d9a1d88fabf12c91d0584060e3dfdc1785be7b38d1aa9291661e2ec99b048a12a96f02ff34eaadbbfa114ecb34dcfdb2f708d9a9fb
+Package config hash: 8f6ecf8ab58351038013b3b89ffe07914b16d012e426899d04d1c821c20e0d13da7aa5fa8517786d21df6b1f367a44ac32cf7200f44d4cf579b4ce5cd77a804f
 
 ---------------------------------------------------------------------------------------------------------
diff --git a/providers/amazon/pyproject.toml b/providers/amazon/pyproject.toml
index e2f4c0a151842..273ca6902261d 100644
--- a/providers/amazon/pyproject.toml
+++ b/providers/amazon/pyproject.toml
@@ -96,10 +96,8 @@ dependencies = [
 ]
 "python3-saml" = [
     "python3-saml>=1.16.0",
-    # python3-saml is dependent on xmlsec and seems they do not pin it, pinning here would be needed
-    # We can remove it after https://github.com/xmlsec/python-xmlsec/issues/344 is fixed
-    "xmlsec!=1.3.15,>=1.3.14",
-    "lxml<5.4.0,>=5.3.2",
+    "xmlsec>=1.3.14",
+    "lxml>=6.0.0",
 ]
 "apache.hive" = [
     "apache-airflow-providers-apache-hive"
diff --git a/pyproject.toml b/pyproject.toml
index 34ae0f3576302..a0b4af0e9a9bc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1262,6 +1262,9 @@ leveldb = [
 [tool.uv]
 required-version = ">=0.6.3"
 no-build-isolation-package = ["sphinx-redoc"]
+# this is needed in order to avoid libxml and xmlsec using different version of libxml2 (binary lxml embeds
+# its own libxml2, while xmlsec uses system one). See https://bugs.launchpad.net/lxml/+bug/2110068
+no-binary-package = ["lxml", "xmlsec"]
 
 [tool.uv.sources]
 # These names must match the names as defined in the pyproject.toml of the workspace items,
diff --git a/scripts/docker/common.sh b/scripts/docker/common.sh
index 4568aa2183b14..d89e726a3057f 100644
--- a/scripts/docker/common.sh
+++ b/scripts/docker/common.sh
@@ -62,7 +62,10 @@ function common::get_packaging_tool() {
         echo
         export PACKAGING_TOOL="pip"
         export PACKAGING_TOOL_CMD="pip"
-        export EXTRA_INSTALL_FLAGS="--root-user-action ignore"
+        # --no-binary  is needed in order to avoid libxml and xmlsec using different version of libxml2
+        # (binary lxml embeds its own libxml2, while xmlsec uses system one).
+        # See https://bugs.launchpad.net/lxml/+bug/2110068
+        export EXTRA_INSTALL_FLAGS="--root-user-action ignore --no-binary lxml,xmlsec"
         export EXTRA_UNINSTALL_FLAGS="--yes"
         export UPGRADE_TO_HIGHEST_RESOLUTION="--upgrade --upgrade-strategy eager"
         export UPGRADE_IF_NEEDED="--upgrade --upgrade-strategy only-if-needed"