diff --git a/.github/workflows/doc-lint.yml b/.github/workflows/doc-lint.yml
index d88474141ba3..b1f02aa44c05 100644
--- a/.github/workflows/doc-lint.yml
+++ b/.github/workflows/doc-lint.yml
@@ -34,7 +34,7 @@ jobs:
           ./utils/check-category.py
       - name: check Chinese doc
         run: |
-          sudo pip3 install zhon
+          sudo pip3 install zhon --break-system-packages
           ./utils/fix-zh-doc-segment.py > \
             /tmp/check.log 2>&1 || (cat /tmp/check.log && exit 1)
           if grep "find broken newline in file: " /tmp/check.log; then
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 781fddff57d7..56775829d3b1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,7 @@ jobs:
         uses: actions/checkout@v4
       - name: spell check
         run: |
-          pip install codespell==2.1.0
+          pipx install codespell==2.1.0 --break-system-packages
           # codespell considers some repo name in go.sum are misspelled
           git grep --cached -l '' | grep -v go.sum |xargs codespell --ignore-words=.ignore_words
       - name: Merge conflict
diff --git a/ci/common.sh b/ci/common.sh
index ae5d12b2b7c6..0fc1462b3c43 100644
--- a/ci/common.sh
+++ b/ci/common.sh
@@ -139,7 +139,7 @@ set_coredns() {
 
     # override DNS configures
     if [ -f "/etc/netplan/50-cloud-init.yaml" ]; then
-        sudo pip3 install yq
+        sudo pip3 install yq --break-system-packages
 
         tmp=$(mktemp)
         yq -y '.network.ethernets.eth0."dhcp4-overrides"."use-dns"=false' /etc/netplan/50-cloud-init.yaml | \