diff --git a/requirements.txt b/requirements.txt
index 2c917dc..bf3a230 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,13 @@
 pbr
 # TODO: consider vendorizing this library for security reasons. It's a fork of
 # an unmaintained repo, without much activity.
-pyfastlz==0.0.1
+# NOTE: PyPI only ships wheels up to cp312 and publishes no sdist, so pip has
+# nothing to build on 3.13+. Fall back to the same tagged source there
+# (built directly, since its FastLZ C source is a git submodule that a
+# plain sdist/tarball would not include).
+# bb65a5f4a01332785c8c636fb6a8b062ff18ca75 === v0.0.1 tag
+pyfastlz==0.0.1; python_version < "3.13"
+pyfastlz @ git+https://github.com/PaulChanHK/python-fastlz.git@bb65a5f4a01332785c8c636fb6a8b062ff18ca75 ; python_version >= "3.13"
 pyOpenSSL
 pyVmomi>=7.0
 PyYAML