diff --git a/pyproject.toml b/pyproject.toml
index 41eb3cc9..588f2e88 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -120,11 +120,20 @@ mypy_path = ["tests"]
 build = "cp311-* cp312-* cp313-*"
 skip = ["pp*", "*_i686", "*-win32", "*-musllinux_i686"]
 build-frontend = "build"
+# Build/test on glibc 2.28: numpy/scipy only publish manylinux_2_27/_2_28 wheels,
+# so the default manylinux2014 (glibc 2.17) test image cannot install them and
+# falls back to compiling scipy from source (no OpenBLAS) and fails. musllinux_1_2
+# (the cibuildwheel default) already has matching numpy/scipy wheels.
+manylinux-x86_64-image = "manylinux_2_28"
+musllinux-x86_64-image = "musllinux_1_2"
 # Smoke-test every built wheel: the native extension imports and computes.
 test-command = 'python -c "import nns, nns._nnscore as c; print(c.lpm(2.0, 0.0, [-2.0, -1.0, 0.5, 3.0]))"'
 
 [tool.cibuildwheel.macos]
 archs = ["x86_64", "arm64"]
+# nanobind's C++17 runtime uses aligned new/delete, which requires macOS 10.13+.
+# cibuildwheel otherwise defaults x86_64 to 10.9 and the build fails to compile.
+environment = { MACOSX_DEPLOYMENT_TARGET = "10.14" }
 
 [tool.cibuildwheel.windows]
 archs = ["AMD64"]