diff --git a/.github/workflows/reusable-cibuildwheel.yml b/.github/workflows/reusable-cibuildwheel.yml
index df7fe468e..3104125e4 100644
--- a/.github/workflows/reusable-cibuildwheel.yml
+++ b/.github/workflows/reusable-cibuildwheel.yml
@@ -101,7 +101,7 @@ jobs:
       shell: bash
 
     - name: Build wheels
-      uses: pypa/cibuildwheel@v2.17.0
+      uses: pypa/cibuildwheel@v2.21.1
       env:
         # CIBW_ARCHS_MACOS: all x86_64 arm64 universal2
         CIBW_ARCHS_MACOS: native
diff --git a/pyproject.toml b/pyproject.toml
index 09f7690df..6e0cc0443 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -184,7 +184,7 @@ LD_LIBRARY_PATH = "$(cat /root/.static-deps-path)/lib64:$(cat /root/.static-deps
 
 [tool.cibuildwheel.macos]
 before-build = [
-  "brew install libssh",  # @0.9.4  # pinning the version does not work
+  "MACOSX_DEPLOYMENT_TARGET=10.9 brew install --build-from-source libssh",  # @0.9.4  # pinning the version does not work
   # FIXME: can we pre-build libssh once in a pre-requisite job?
   # NOTE: Currently we use a brew-installed libssh build that also
   # NOTE: pulls-in openssl@1.1 as well. In the future we may want to
diff --git a/requirements-build.txt b/requirements-build.txt
index 1e1a21fb8..382b4a530 100644
--- a/requirements-build.txt
+++ b/requirements-build.txt
@@ -8,7 +8,7 @@ cython==3.0.12
     # via -r -
 expandvars==0.9.0
     # via -r -
-packaging==24.0
+packaging==24.1
     # via setuptools-scm
 pyparsing==3.0.9
     # via packaging
@@ -16,7 +16,7 @@ setuptools-scm==8.1.0
     # via -r -
 tomli==2.0.1
     # via setuptools-scm
-typing-extensions==4.10.0
+typing-extensions==4.12.2
     # via setuptools-scm
 wheel==0.37.1
     # via -r -