diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index f29019f..d9cad9c 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -77,7 +77,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install cibuildwheel
         # Nb. keep cibuildwheel version pin consistent with job below
-        run: pipx install cibuildwheel==2.21.3
+        run: pipx install cibuildwheel==3.1.4
       - id: set-matrix
         # Once we have the windows build figured out, it can be added here
         # by updating the matrix to include windows builds as well.
@@ -126,7 +126,7 @@ jobs:
           platforms: all
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.21.3
+        uses: pypa/cibuildwheel@v3.1.4
         with:
           only: ${{ matrix.only }}
         env:
diff --git a/doc/source/requirements.txt b/doc/source/requirements.txt
index 6b78694..ffb2b6d 100644
--- a/doc/source/requirements.txt
+++ b/doc/source/requirements.txt
@@ -1,4 +1,4 @@
-lxml>=3.8
+lxml==6.0.2
 importlib_metadata;python_version < '3.8'
 packaging
 Sphinx>=3
diff --git a/pyproject.toml b/pyproject.toml
index bb0c459..2b2d2d0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=42", "wheel", "setuptools_scm[toml]>=3.4", "pkgconfig>=1.5.1", "lxml>=3.8, !=4.7.0"]
+requires = ["setuptools==80.9.0", "wheel", "setuptools_scm[toml]>=3.4", "pkgconfig>=1.5.1", "lxml==6.0.2"]
 
 [tool.mypy]
 files = ['src']
@@ -100,6 +100,7 @@ build-verbosity = 1
 build-frontend = "build"
 skip = [
     "pp*",  # Skips PyPy builds (pp38-*, pp39-*, etc.)
+    "*musllinux_riscv64"  # maturin and ruff currently don’t support the musl + riscv64 target
 ]
 test-command = "pytest -v --color=yes {package}/tests"
 before-test = "pip install -r requirements-test.txt"
@@ -109,7 +110,7 @@ test-skip = "*-macosx_arm64"
 PYXMLSEC_STATIC_DEPS = "true"
 
 [tool.cibuildwheel.linux]
-archs = ["x86_64", "aarch64"]
+archs = ["x86_64", "aarch64", "riscv64"]
 environment-pass = [
     "PYXMLSEC_LIBXML2_VERSION",
     "PYXMLSEC_LIBXSLT_VERSION",
diff --git a/requirements-test.txt b/requirements-test.txt
index 52a31f0..ad135d9 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -2,4 +2,4 @@
 
 pytest==8.4.1
 lxml-stubs==0.5.1
-ruff[format]==0.12.3
+ruff[format]==0.13.0
diff --git a/requirements.txt b/requirements.txt
index 7aa6718..8221c37 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-lxml==6.0.0
+lxml==6.0.2
diff --git a/setup.py b/setup.py
index 014476c..624169c 100644
--- a/setup.py
+++ b/setup.py
@@ -404,9 +404,8 @@ def prepare_static_build(self, build_platform):
             ldflags.append(env['LDFLAGS'])
 
         cross_compiling = False
-        if build_platform == 'darwin':
-            import platform
 
+        if build_platform == 'darwin':
             arch = self.plat_name.rsplit('-', 1)[1]
             if arch != platform.machine() and arch in ('x86_64', 'arm64'):
                 self.info(f'Cross-compiling for {arch}')
@@ -423,6 +422,19 @@ def prepare_static_build(self, build_platform):
         self.info('Building OpenSSL')
         openssl_dir = next(self.build_libs_dir.glob('openssl-*'))
         openssl_config_cmd = [prefix_arg, 'no-shared', '-fPIC', '--libdir=lib']
+        if platform.machine() == 'riscv64':
+            # add `no-asm` flag for openssl while build for riscv64
+
+            # on openssl 3.5.2, When building for riscv64, ASM code is used by default.
+            # However, this version of the assembly code will report during the build:
+
+            # relocation truncated to fit: R_RISCV_JAL against symbol `AES_set_encrypt_key' defined in .text section in /project/build/tmp/prefix/lib/libcrypto.a(libcrypto-lib-aes-riscv64.o) # noqa: E501
+
+            # This [line] (https://github.com/openssl/openssl/blob/0893a62353583343eb712adef6debdfbe597c227/crypto/aes/asm/aes-riscv64.pl#L1069) of code cannot be completed normally because the jump address of the static link library used by xmlsec is too large. # noqa: E501
+            # may be we can consider filing a related issue with OpenSSL later.
+            # However, for now, for convenience, we can simply disable ASM for riscv64.
+            # This will result in some performance degradation, but this is acceptable.
+            openssl_config_cmd.append('no-asm')
         if cross_compiling:
             openssl_config_cmd.insert(0, './Configure')
             openssl_config_cmd.append(cross_compiling.triplet)