diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ccb08de..376a8c7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -43,8 +43,20 @@ jobs:
           if file /opt/socket_vmnet.arm64/bin/* | grep -q x86_64 ; then false ; fi
       - name: Print launchd status (shared mode)
         run: launchctl print system/io.github.lima-vm.socket_vmnet
+      - name: Fetch homebrew-core commit messages
+        uses: actions/checkout@v4
+        with:
+          # needed by ./hack/brew-install-version.sh
+          repository: homebrew/homebrew-core
+          path: homebrew-core
+          fetch-depth: 0
+          filter: tree:0
       - name: Install test dependencies
-        run: brew install qemu bash coreutils
+        run: |
+          brew install bash coreutils
+          # QEMU 9.1.0 seems to break on GitHub runners, both on Monterey and Ventura
+          # We revert back to 8.2.1, which seems to work fine
+          ./hack/brew-install-version.sh qemu 8.2.1
       - name: Test (shared mode)
         run: ./test/test.sh /var/run/socket_vmnet
 # Bridged mode cannot be tested on GHA
diff --git a/hack/brew-install-version.sh b/hack/brew-install-version.sh
new file mode 100755
index 0000000..fbd6028
--- /dev/null
+++ b/hack/brew-install-version.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# This script only works for formulas in the homebrew-core.
+# It assumes the homebrew-core has been checked out into ./homebrew-core.
+# It only needs commit messages, so the checkout can be filtered with tree:0.
+
+set -eu -o pipefail
+
+FORMULA=$1
+VERSION=$2
+
+export HOMEBREW_NO_AUTO_UPDATE=1
+export HOMEBREW_NO_INSTALL_UPGRADE=1
+export HOMEBREW_NO_INSTALL_CLEANUP=1
+
+TAP=lima/tap
+if ! brew tap | grep -q "^${TAP}\$"; then
+	brew tap-new "$TAP"
+fi
+
+# Get the latest commit id for the commit that updated this bottle
+SHA=$(git -C homebrew-core log --max-count 1 --grep "^${FORMULA}: update ${VERSION} bottle" --format="%H")
+if [[ -z $SHA ]]; then
+	echo "${FORMULA} ${VERSION} not found"
+	exit 1
+fi
+
+OUTPUT="$(brew --repo "$TAP")/Formula/${FORMULA}.rb"
+RAW="https://raw.githubusercontent.com/Homebrew/homebrew-core"
+curl -s "${RAW}/${SHA}/Formula/${FORMULA::1}/${FORMULA}.rb" -o "$OUTPUT"
+
+if brew ls -1 | grep -q "^${FORMULA}\$"; then
+	brew uninstall "$FORMULA" --ignore-dependencies
+fi
+brew install "${TAP}/${FORMULA}"