diff --git a/.github/workflows/module_ci.yml b/.github/workflows/module_ci.yml
index 0c45118..9468a5c 100644
--- a/.github/workflows/module_ci.yml
+++ b/.github/workflows/module_ci.yml
@@ -25,7 +25,7 @@ on:
         default: '3.2'
         type: "string"
       additional_packages:
-        description: "Space-separated list of OS packages to install on the runner (apt-get)"
+        description: "Space-separated list of extra OS packages to install on the runner (apt-get), in addition to libcurl4-openssl-dev"
         required: false
         default: ''
         type: "string"
@@ -60,13 +60,17 @@ jobs:
           persist-credentials: false
 
       - name: "Install additional packages"
-        if: ${{ inputs.additional_packages != '' }}
+        if: runner.os == 'Linux'
+        # libcurl4-openssl-dev is always installed for the Ruby 4 lane: faraday-follow_redirects
+        # <= 0.4 requires ruby < 4, so bundler can't use puppet_forge 4.x-6.0.x there and falls
+        # back to r10k 3.x -> puppet_forge 3.2 -> faraday 1.x. faraday 1.x depends on its adapter
+        # gems, including faraday-patron -> patron, a native extension that needs libcurl headers.
         # Refresh the package index first: the runner image's baked-in apt lists can lag
         # behind the live archive, so installing straight away can 404 on a package whose
         # exact cached version has since been superseded and evicted from the mirror pool.
         run: |
           sudo apt-get update
-          sudo apt-get install -y ${{ inputs.additional_packages }}
+          sudo apt-get install -y libcurl4-openssl-dev ${{ inputs.additional_packages }}
 
       - name: "Configure forge authentication"
         env:
@@ -121,13 +125,17 @@ jobs:
           persist-credentials: false
 
       - name: "Install additional packages"
-        if: ${{ inputs.additional_packages != '' }}
+        if: runner.os == 'Linux'
+        # libcurl4-openssl-dev is always installed for the Ruby 4 lane: faraday-follow_redirects
+        # <= 0.4 requires ruby < 4, so bundler can't use puppet_forge 4.x-6.0.x there and falls
+        # back to r10k 3.x -> puppet_forge 3.2 -> faraday 1.x. faraday 1.x depends on its adapter
+        # gems, including faraday-patron -> patron, a native extension that needs libcurl headers.
         # Refresh the package index first: the runner image's baked-in apt lists can lag
         # behind the live archive, so installing straight away can 404 on a package whose
         # exact cached version has since been superseded and evicted from the mirror pool.
         run: |
           sudo apt-get update
-          sudo apt-get install -y ${{ inputs.additional_packages }}
+          sudo apt-get install -y libcurl4-openssl-dev ${{ inputs.additional_packages }}
 
       - name: "Configure forge authentication"
         env: