diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8388feb..c2651e0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -70,6 +70,10 @@ jobs:
   macos-universal:
     runs-on: macos-15
     steps:
+      - name: Setup Xcode 16.2 (16.3+ incompatible with libgit2's zlib)
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: '16.2'
       - uses: actions/checkout@v4
         with:
           submodules: recursive
diff --git a/tools/ssh2.py b/tools/ssh2.py
index 581ad46..9380728 100644
--- a/tools/ssh2.py
+++ b/tools/ssh2.py
@@ -15,6 +15,7 @@ def build_library(env, deps):
         "CMAKE_DISABLE_FIND_PACKAGE_ZLIB": 1,
         "CMAKE_DISABLE_FIND_PACKAGE_OPENSSL": 1,
         "CRYPTO_BACKEND": "OpenSSL",
+        "CMAKE_POLICY_VERSION_MINIMUM": 3.5,
     }
 
     if env["platform"] != "windows":