diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7174cad692e8beb3efe7765f48408931a1f82c77..aecb0d00056d4fb3cff330b14f08ef5bda72d72b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,6 +30,6 @@ test-job:
     - molecule syntax --scenario-name default
     - molecule lint --scenario-name default
     - molecule create --scenario-name default
-    - molecule converge --scenario-name default
-    - molecule idempotence --scenario-name default
+    - molecule converge --scenario-name default -- --skip-tags no-ci
+    - molecule idempotence --scenario-name default -- --skip-tags no-ci
     # - molecule verify --scenario-name default
diff --git a/molecule/resources/playbooks/converge.yml b/molecule/resources/playbooks/converge.yml
index 5e9e9dfbc4f576580857f6866eaf5fd49eb1c15b..953cbb4ddd8614f4c6b1c99fba956bdf9c852a17 100644
--- a/molecule/resources/playbooks/converge.yml
+++ b/molecule/resources/playbooks/converge.yml
@@ -14,4 +14,4 @@
       become: true
       when: ansible_os_family == "RedHat"
   roles:
-    - {role: "ansible_lza_repair", become: true}
+    - {role: "ansible_lza_repair", become: true, skip-tags: "no-ci"}
diff --git a/molecule/resources/playbooks/prepare.yml b/molecule/resources/playbooks/prepare.yml
index 0db49d6fba53c1d916ea3387487a6250ef9ae812..f03054fe407176213a78ed2040c6dcd36e3271d7 100644
--- a/molecule/resources/playbooks/prepare.yml
+++ b/molecule/resources/playbooks/prepare.yml
@@ -27,6 +27,15 @@
             mode: "0644"
           become: true
       when: ansible_os_family == "Debian"
+    - name: install tooling before running the actual tests, so we're not bound by the fixed versions
+      ansible.builtin.apt:
+        name: [
+          "checkit-tiff*",
+          "fixit-tiff",
+        ]
+        state: latest
+        update_cache: true
+      become: true
 
     - name: configure additional package repositories for RedHat
       block: