diff --git a/tests/__init__.py b/tests/__init__.py
index 02757774e..8c0d15b68 100644
--- a/tests/__init__.py
+++ b/tests/__init__.py
@@ -25,6 +25,7 @@ class ImageConfig:
     distribution: Distribution
     release: str
     debug_shell: bool
+    snapshot: Optional[str] = None
 
 
 class Image:
@@ -92,6 +93,9 @@ def build(
         opt: list[PathString] = [
             "--distribution", str(self.config.distribution),
             "--release", self.config.release,
+            # Pass the snapshot explicitly so that extension builds which don't read mkosi.local.conf
+            # still pin the same snapshot as the base image.
+            *(["--snapshot", self.config.snapshot] if self.config.snapshot else []),
             *(f"--kernel-command-line={i}" for i in kcl),
             "--force",
             "--incremental=strict",
diff --git a/tests/conftest.py b/tests/conftest.py
index dd164dcdf..0e5e118f7 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -42,15 +42,16 @@ def pytest_addoption(parser: Any) -> None:
 def config(request: Any) -> ImageConfig:
     distribution = cast(Distribution, request.config.getoption("--distribution"))
     with resource_path(mkosi.resources) as resources:
-        release = cast(
-            str,
-            request.config.getoption("--release")
-            or parse_config(["-d", str(distribution)], resources=resources)[2][0].release,
-        )
+        # Reads the local configuration (mkosi.local.conf) written by integration-test-setup.sh.
+        parsed = parse_config(["-d", str(distribution)], resources=resources)[2][0]
+    release = cast(str, request.config.getoption("--release") or parsed.release)
     return ImageConfig(
         distribution=distribution,
         release=release,
         debug_shell=request.config.getoption("--debug-shell"),
+        # Pin the same snapshot as the main image so builds that don't read mkosi.local.conf still
+        # use it (e.g. the extension build, which passes --directory '').
+        snapshot=parsed.snapshot,
     )
 
 
diff --git a/tools/integration-test-setup.sh b/tools/integration-test-setup.sh
index f7dedcd96..ca9342b68 100755
--- a/tools/integration-test-setup.sh
+++ b/tools/integration-test-setup.sh
@@ -28,10 +28,12 @@ group "create_config"
 
 # safety check: don't clobber local config
 CI_MARKER='# CI config generated by tools/integration-test-setup.sh'
-if [ -e mkosi.local.conf ] && ! grep -qF "$CI_MARKER" mkosi.local.conf; then
-    echo "There is an existing mkosi.local.conf, aborting" >&2
-    exit 1
-fi
+for conf in mkosi.local.conf mkosi.tools.conf/mkosi.local.conf; do
+    if [ -e "$conf" ] && ! grep -qF "$CI_MARKER" "$conf"; then
+        echo "There is an existing $conf, aborting" >&2
+        exit 1
+    fi
+done
 
 cat >mkosi.local.conf <<EOF
 ${CI_MARKER}
@@ -52,6 +54,35 @@ Environment=SYSTEMD_REPART_MKFS_OPTIONS_EROFS="--quiet"
 KVM=yes
 EOF
 
+# openSUSE Tumbleweed mirrors frequently lag behind freshly published snapshots, especially to US based mirrors.
+# Pin the second-to-last snapshot (see https://github.com/systemd/mkosi/issues/4365). Snapshot= is only
+# supported for openSUSE on x86-64, and is not propagated to the tools tree, so set it separately for both.
+if [ "$(uname -m)" = "x86_64" ] && { [ "$distribution" = "opensuse" ] || [ "$tools" = "opensuse" ]; }; then
+    snapshot="$(curl -fsSL --retry 5 https://download.opensuse.org/history/ |
+        grep -oP 'href="\./\K20[0-9]{6}(?=/")' | sort -u | tail -2 | head -1)"
+    if [ -z "$snapshot" ]; then
+        echo "Failed to determine an openSUSE snapshot to pin" >&2
+        exit 1
+    fi
+    echo "Pinning openSUSE snapshot ${snapshot}" >&2
+
+    if [ "$distribution" = "opensuse" ]; then
+        cat >>mkosi.local.conf <<EOF
+
+[Distribution]
+Snapshot=${snapshot}
+EOF
+    fi
+
+    if [ "$tools" = "opensuse" ]; then
+        cat >mkosi.tools.conf/mkosi.local.conf <<EOF
+${CI_MARKER}
+[Distribution]
+Snapshot=${snapshot}
+EOF
+    fi
+fi
+
 # TODO: Remove once all distros have recent enough systemd that knows systemd.default_device_timeout_sec.
 mkdir -p mkosi-initrd/mkosi.extra/usr/lib/systemd/system.conf.d
 cat >mkosi-initrd/mkosi.extra/usr/lib/systemd/system.conf.d/device-timeout.conf <<EOF