diff --git a/tests/e2e/Dockerfile.jetson b/tests/e2e/Dockerfile.jetson
index 0ff0761..8175e52 100644
--- a/tests/e2e/Dockerfile.jetson
+++ b/tests/e2e/Dockerfile.jetson
@@ -85,7 +85,30 @@ COPY src ./src
 # would be to layer a venv on top of the pre-installed torch, but that
 # would shadow the Tegra-tuned torch wheel and break `.cuda()`. The image
 # IS the environment; embracing system-pip is the path of least drift.
-RUN pip3 install --no-cache-dir --break-system-packages -e ".[dev]"
+#
+# The dustynv base bakes two stale indexes into /etc/pip.conf:
+#   * http://jetson.webredirect.org/jp6/cu126 — a local mirror only
+#     reachable from the maintainer's LAN; DNS-fails everywhere else.
+#   * https://pypi.ngc.nvidia.com — NVIDIA NGC; doesn't have most
+#     standard packages like setuptools>=68.
+# Both are intended for installing Tegra-tuned PyTorch wheels, which
+# we don't need to do — they're already in the base image. Wipe the
+# bake'd config and pin to upstream PyPI for the dev extras only.
+RUN rm -f /etc/pip.conf /root/.pip/pip.conf /root/.config/pip/pip.conf
+
+# Bump pip from 24.2 → latest. 24.2 rejects pre-release versions for
+# specifiers like `gtsam<5.0,>=4.2` even when 4.3a0 is the only wheel
+# PyPI ships for aarch64 (the Colima image lands on the same gtsam
+# 4.3a0 because its pip 26.x has explicit "fallback to pre-release
+# when no stable candidates match" logic). Keeping pip current also
+# avoids future drift between the two harnesses.
+RUN pip3 install --no-cache-dir --break-system-packages \
+        --index-url https://pypi.org/simple \
+        --upgrade pip
+
+RUN pip3 install --no-cache-dir --break-system-packages \
+        --index-url https://pypi.org/simple \
+        -e ".[dev]"
 
 # ENTRYPOINT mirrors the Colima Dockerfile — pytest discovers both
 # `tests/e2e/replay/` (heavy tier2 ACs run with GPS_DENIED_TIER=2) and