diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 7ee5ecb6d..4a8ee56e0 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -89,9 +89,6 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
         id: go
 
-      - name: Install Cloudsmith CLI
-        run: pip install --upgrade cloudsmith-cli
-
       - name: Patch ASN1
         run: make patch-asn1-sudo
 
@@ -111,6 +108,11 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TESLA_CLIENT_ID: ${{ secrets.TESLA_CLIENT_ID }}
 
+      - name: Install Cloudsmith CLI
+        run: |
+          python3 -m venv venv
+          venv/bin/pip install --upgrade cloudsmith-cli
+
       - name: Publish .deb to Cloudsmith
         env:
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c992aa03e..2e5d98704 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -68,9 +68,6 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
         id: go
 
-      - name: Install Cloudsmith CLI
-        run: pip install --upgrade cloudsmith-cli
-
       - name: Patch ASN1
         run: make patch-asn1-sudo
 
@@ -105,6 +102,11 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           TESLA_CLIENT_ID: ${{ secrets.TESLA_CLIENT_ID }}
 
+      - name: Install Cloudsmith CLI
+        run: |
+          python3 -m venv venv
+          venv/bin/pip install --upgrade cloudsmith-cli
+
       - name: Publish .deb to Cloudsmith
         env:
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
diff --git a/Makefile b/Makefile
index 28233cd95..b930ff2c8 100644
--- a/Makefile
+++ b/Makefile
@@ -96,12 +96,12 @@ publish-release::
 
 apt-nightly::
 	$(foreach file, $(wildcard $(PACKAGES)/*.deb), \
-		cloudsmith push deb evcc/unstable/any-distro/any-version $(file); \
+		venv/bin/cloudsmith push deb evcc/unstable/any-distro/any-version $(file); \
 	)
 
 apt-release::
 	$(foreach file, $(wildcard $(PACKAGES)/*.deb), \
-		cloudsmith push deb evcc/stable/any-distro/any-version $(file); \
+		venv/bin/cloudsmith push deb evcc/stable/any-distro/any-version $(file); \
 	)
 
 # gokrazy image