diff --git a/Justfile b/Justfile
index 41f1225562..ce77decf41 100644
--- a/Justfile
+++ b/Justfile
@@ -63,7 +63,11 @@ nocache := env("BOOTC_nocache", "")
 _nocache_arg := if nocache != "" { "--no-cache" } else { "" }
 _baseconfigs_env := if baseconfigs != "" { "--env=BOOTC_baseconfigs=" + baseconfigs } else { "" }
 testimage_label := "bootc.testimage=1"
-lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:latest"
+# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that
+# replaced it has no sigstore signature for the registry.access.redhat.com
+# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
+# Keep in sync with hack/lbi.
+lbi_images := "quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728"
 fedora-coreos := "quay.io/fedora/fedora-coreos:testing-devel"
 generic_buildargs := ""
 _extra_src_args := if extra_src != "" { "-v " + extra_src + ":/run/extra-src:ro --security-opt=label=disable" } else { "" }
diff --git a/hack/lbi/podman.image b/hack/lbi/podman.image
index cb37cc613e..87f22f9364 100644
--- a/hack/lbi/podman.image
+++ b/hack/lbi/podman.image
@@ -1,2 +1,5 @@
 [Image]
-Image=registry.access.redhat.com/ubi9/podman:latest
+# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that
+# replaced it has no sigstore signature for the registry.access.redhat.com
+# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
+Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728
diff --git a/hack/provision-packit.sh b/hack/provision-packit.sh
index 52f81cc54c..a12a1a674e 100755
--- a/hack/provision-packit.sh
+++ b/hack/provision-packit.sh
@@ -92,8 +92,8 @@ if [[ -n "${BOOTC_source_image_archive:-}" ]]; then
     podman save --format oci-archive -o "${BOOTC_source_image_archive#/sysroot}" localhost/bootc
 fi
 
-# Keep these in sync with what's used in hack/lbi
-podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:latest
+# Keep these in sync with what's used in hack/lbi; ubi9/podman is pinned, see hack/lbi/podman.image
+podman pull -q --retry 5 --retry-delay 5s quay.io/curl/curl:latest quay.io/curl/curl-base:latest registry.access.redhat.com/ubi9/podman:9.8-1793032728
 
 # Run system-reinstall-bootc
 # TODO make it more scriptable instead of expect + send
diff --git a/tmt/tests/booted/test-logically-bound-install.nu b/tmt/tests/booted/test-logically-bound-install.nu
index d2c36fcbfc..27a4ba1c1b 100644
--- a/tmt/tests/booted/test-logically-bound-install.nu
+++ b/tmt/tests/booted/test-logically-bound-install.nu
@@ -12,7 +12,7 @@ use tap.nu
 let expected_images = [
     "quay.io/curl/curl:latest",
     "quay.io/curl/curl-base:latest",
-    "registry.access.redhat.com/ubi9/podman:latest" # this image is signed
+    "registry.access.redhat.com/ubi9/podman:9.8-1793032728" # this image is signed; pinned, see hack/lbi/podman.image
 ]
 
 def validate_images [images: list<string>] {
diff --git a/tmt/tests/lbi/usr/share/containers/systemd/podman.image b/tmt/tests/lbi/usr/share/containers/systemd/podman.image
index cb37cc613e..87f22f9364 100644
--- a/tmt/tests/lbi/usr/share/containers/systemd/podman.image
+++ b/tmt/tests/lbi/usr/share/containers/systemd/podman.image
@@ -1,2 +1,5 @@
 [Image]
-Image=registry.access.redhat.com/ubi9/podman:latest
+# Pinned to ubi9/podman 9.8-1793032728: the 9.8-1793203936 build that
+# replaced it has no sigstore signature for the registry.access.redhat.com
+# :latest tag, so the default sigstoreSigned policy rejects pulling it by tag.
+Image=registry.access.redhat.com/ubi9/podman:9.8-1793032728