diff --git a/cibuildwheel/resources/constraints-pyodide312.txt b/cibuildwheel/resources/constraints-pyodide312.txt
index 4a9e13238..f0c7ed52b 100644
--- a/cibuildwheel/resources/constraints-pyodide312.txt
+++ b/cibuildwheel/resources/constraints-pyodide312.txt
@@ -23,7 +23,7 @@ filelock==3.29.0
     # via
     #   python-discovery
     #   virtualenv
-idna==3.14
+idna==3.15
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -37,8 +37,7 @@ packaging==26.2
     #   build
     #   pyodide-build
     #   wheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1.1
     # via -r .nox/update_constraints/tmp/constraints-pyodide.in
 platformdirs==4.9.6
     # via
@@ -63,9 +62,9 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
-requests==2.34.0
+requests==2.34.1
     # via pyodide-build
 rich==15.0.0
     # via
@@ -82,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via
     #   build
     #   pyodide-build
diff --git a/cibuildwheel/resources/constraints-pyodide313.txt b/cibuildwheel/resources/constraints-pyodide313.txt
index d74cb73f5..f0c7ed52b 100644
--- a/cibuildwheel/resources/constraints-pyodide313.txt
+++ b/cibuildwheel/resources/constraints-pyodide313.txt
@@ -23,7 +23,7 @@ filelock==3.29.0
     # via
     #   python-discovery
     #   virtualenv
-idna==3.14
+idna==3.15
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -62,9 +62,9 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
-requests==2.34.0
+requests==2.34.1
     # via pyodide-build
 rich==15.0.0
     # via
@@ -81,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via
     #   build
     #   pyodide-build
diff --git a/cibuildwheel/resources/constraints-pyodide314.txt b/cibuildwheel/resources/constraints-pyodide314.txt
index d74cb73f5..f0c7ed52b 100644
--- a/cibuildwheel/resources/constraints-pyodide314.txt
+++ b/cibuildwheel/resources/constraints-pyodide314.txt
@@ -23,7 +23,7 @@ filelock==3.29.0
     # via
     #   python-discovery
     #   virtualenv
-idna==3.14
+idna==3.15
     # via requests
 leb128==1.0.9
     # via auditwheel-emscripten
@@ -62,9 +62,9 @@ pyodide-lock==0.1.3
     # via pyodide-build
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
-requests==2.34.0
+requests==2.34.1
     # via pyodide-build
 rich==15.0.0
     # via
@@ -81,7 +81,7 @@ typing-inspection==0.4.2
     # via pydantic
 urllib3==2.7.0
     # via requests
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via
     #   build
     #   pyodide-build
diff --git a/cibuildwheel/resources/constraints-python310.txt b/cibuildwheel/resources/constraints-python310.txt
index e36c11686..94d94ed10 100644
--- a/cibuildwheel/resources/constraints-python310.txt
+++ b/cibuildwheel/resources/constraints-python310.txt
@@ -14,7 +14,7 @@ filelock==3.29.0
     # via
     #   python-discovery
     #   virtualenv
-importlib-metadata==9.0.0
+importlib-metadata==9.0.0 ; python_full_version < '3.10.2'
     # via build
 macholib==1.16.4
     # via delocate
@@ -24,8 +24,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1.1 ; (python_full_version < '3.13' and implementation_name != 'graalpy') or (python_full_version < '3.13' and sys_platform != 'win32')
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -33,15 +32,15 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
-tomli==2.4.1
+tomli==2.4.1 ; python_full_version < '3.11'
     # via build
 typing-extensions==4.15.0
     # via
     #   delocate
     #   virtualenv
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.1
+zipp==3.23.1 ; python_full_version < '3.10.2'
     # via importlib-metadata
diff --git a/cibuildwheel/resources/constraints-python311.txt b/cibuildwheel/resources/constraints-python311.txt
index 043692b32..161456be5 100644
--- a/cibuildwheel/resources/constraints-python311.txt
+++ b/cibuildwheel/resources/constraints-python311.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1.1 ; (python_full_version < '3.13' and implementation_name != 'graalpy') or (python_full_version < '3.13' and sys_platform != 'win32')
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/cibuildwheel/resources/constraints-python312.txt b/cibuildwheel/resources/constraints-python312.txt
index 043692b32..161456be5 100644
--- a/cibuildwheel/resources/constraints-python312.txt
+++ b/cibuildwheel/resources/constraints-python312.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1.1 ; (python_full_version < '3.13' and implementation_name != 'graalpy') or (python_full_version < '3.13' and sys_platform != 'win32')
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/cibuildwheel/resources/constraints-python313.txt b/cibuildwheel/resources/constraints-python313.txt
index 043692b32..003f31bfa 100644
--- a/cibuildwheel/resources/constraints-python313.txt
+++ b/cibuildwheel/resources/constraints-python313.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/cibuildwheel/resources/constraints-python314.txt b/cibuildwheel/resources/constraints-python314.txt
index 043692b32..003f31bfa 100644
--- a/cibuildwheel/resources/constraints-python314.txt
+++ b/cibuildwheel/resources/constraints-python314.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/cibuildwheel/resources/constraints-python315.txt b/cibuildwheel/resources/constraints-python315.txt
index 043692b32..003f31bfa 100644
--- a/cibuildwheel/resources/constraints-python315.txt
+++ b/cibuildwheel/resources/constraints-python315.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/cibuildwheel/resources/constraints-python39.txt b/cibuildwheel/resources/constraints-python39.txt
index e23de6274..5a79dedc2 100644
--- a/cibuildwheel/resources/constraints-python39.txt
+++ b/cibuildwheel/resources/constraints-python39.txt
@@ -14,7 +14,7 @@ filelock==3.19.1
     # via
     #   python-discovery
     #   virtualenv
-importlib-metadata==8.7.1
+importlib-metadata==8.7.1 ; python_full_version < '3.10.2'
     # via build
 macholib==1.16.4
     # via delocate
@@ -24,7 +24,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.0.1
+pip==26.0.1 ; (python_full_version < '3.10' and implementation_name != 'graalpy') or (python_full_version >= '3.13' and implementation_name != 'graalpy') or (python_full_version < '3.10' and sys_platform != 'win32') or (python_full_version >= '3.13' and sys_platform != 'win32') or (implementation_name == 'graalpy' and sys_platform == 'win32')
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.4.0
     # via
@@ -32,15 +32,15 @@ platformdirs==4.4.0
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
-tomli==2.4.1
+tomli==2.4.1 ; python_full_version < '3.11'
     # via build
 typing-extensions==4.15.0
     # via
     #   delocate
     #   virtualenv
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
-zipp==3.23.1
+zipp==3.23.1 ; python_full_version < '3.10.2'
     # via importlib-metadata
diff --git a/cibuildwheel/resources/constraints.in b/cibuildwheel/resources/constraints.in
index 8f40eb610..bf1f9b7b8 100644
--- a/cibuildwheel/resources/constraints.in
+++ b/cibuildwheel/resources/constraints.in
@@ -1,4 +1,5 @@
-pip
+pip>=26.1.1; (implementation_name != "graalpy" or platform_system != "Windows") and python_version >= "3.10" and python_version < "3.13"
+pip<26.1.1; implementation_name == "graalpy" and platform_system == "Windows" or python_version < "3.10" or python_version >= "3.13"
 build
 delocate
 delvewheel
diff --git a/cibuildwheel/resources/constraints.txt b/cibuildwheel/resources/constraints.txt
index 043692b32..003f31bfa 100644
--- a/cibuildwheel/resources/constraints.txt
+++ b/cibuildwheel/resources/constraints.txt
@@ -22,8 +22,7 @@ packaging==26.2
     #   delocate
 pefile==2024.8.26
     # via delvewheel
-pip==26.1.1; implementation_name != "graalpy" or platform_system != "Windows"
-pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
+pip==26.1
     # via -r cibuildwheel/resources/constraints.in
 platformdirs==4.9.6
     # via
@@ -31,9 +30,9 @@ platformdirs==4.9.6
     #   virtualenv
 pyproject-hooks==1.2.0
     # via build
-python-discovery==1.3.0
+python-discovery==1.3.1
     # via virtualenv
 typing-extensions==4.15.0
     # via delocate
-virtualenv==21.3.1
+virtualenv==21.3.3
     # via -r cibuildwheel/resources/constraints.in
diff --git a/noxfile.py b/noxfile.py
index 319f1b915..b0e341e50 100755
--- a/noxfile.py
+++ b/noxfile.py
@@ -88,6 +88,7 @@ def update_constraints(session: nox.Session) -> None:
             "compile",
             f"--python-version={python_version}",
             "--upgrade",
+            "--no-strip-markers",
             resources / "constraints.in",
             f"--output-file={output_file}",
             env=env,