diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
index d4387aed..3af1968a 100644
--- a/.github/workflows/elixir-ci-reusable.yml
+++ b/.github/workflows/elixir-ci-reusable.yml
@@ -73,6 +73,15 @@ on:
         type: string
         required: false
         default: "1.17"
+      rebar3-version:
+        description: >-
+          rebar3 version for erlef/setup-beam. When set, setup-beam installs
+          rebar3 from GitHub releases instead of letting `mix local.rebar`
+          fetch it from builds.hex.pm — a workaround for the OTP TLS
+          `key_usage_mismatch` cert error on that host. Empty = unchanged.
+        type: string
+        required: false
+        default: ""
       enable_dialyzer:
         description: Run `mix dialyzer` (slow cold-cache; off by default)
         type: boolean
@@ -152,6 +161,7 @@ jobs:
         with:
           otp-version: ${{ inputs.otp-version }}
           elixir-version: ${{ inputs.elixir-version }}
+          rebar3-version: ${{ inputs.rebar3-version }}
 
       - name: Cache deps
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5