diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 60da7ee..212b02c 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -197,10 +197,7 @@ jobs:
       - name: Prepare environment
         run: |
           pip install typer pyyaml gitpython packaging
-          # HACK: DO NOT MERGE - clone the plot-test fix branches instead of the real ones
-          git clone https://github.com/chrisburr/DIRAC.git -b "fix/plot-tests-numpy-bins-${DIRAC_BRANCH#rel-}" DIRACRepo
-        env:
-          DIRAC_BRANCH: ${{ matrix.dirac-branch }}
+          git clone https://github.com/DIRACGrid/DIRAC.git -b "${{ matrix.dirac-branch }}" DIRACRepo
       - name: Run tests
         run: |
           DIRACOS_TARBALL_PATH=$(echo ${PWD}/DIRACOS-*.sh)
diff --git a/construct.yaml b/construct.yaml
index 1656483..59876d8 100644
--- a/construct.yaml
+++ b/construct.yaml
@@ -39,7 +39,13 @@ specs:
   - openssl >=3
   # Security
   - certifi
-  - m2crypto >=0.43
+  # Upper pin: m2crypto 0.46.0 rewrote ssl_read() in src/SWIG/_ssl.i and inverted the
+  # handling of ssl_sleep_with_timeout()'s return value (and dropped the gettimeofday()
+  # that initialises the deadline). Any read() on a connection with a timeout set now
+  # busy-loops and returns with a stale SSLTimeoutError set, which surfaces as
+  # "SystemError: <built-in function ssl_read> returned a result with an exception set"
+  # and breaks all DIRAC DISET/dips connections. Still unfixed upstream as of 0.49.0.
+  - m2crypto >=0.43,<0.46
   - pyasn1 >0.4.1
   - pyasn1-modules
   - tornado_m2crypto >=0.1.4