diff --git a/ci/test_wheel.sh b/ci/test_wheel.sh
index c7c7539061..d8808c9cde 100755
--- a/ci/test_wheel.sh
+++ b/ci/test_wheel.sh
@@ -12,7 +12,19 @@ RAPIDS_PY_CUDA_SUFFIX="$(rapids-wheel-ctk-name-gen "${RAPIDS_CUDA_VERSION}")"
 LIBKVIKIO_WHEELHOUSE=$(RAPIDS_PY_WHEEL_NAME="libkvikio_${RAPIDS_PY_CUDA_SUFFIX}" rapids-download-wheels-from-github cpp)
 KVIKIO_WHEELHOUSE=$(rapids-download-from-github "$(rapids-package-name "wheel_python" kvikio --stable --cuda "$RAPIDS_CUDA_VERSION")")
 
-rapids-pip-retry install -v \
+# generate constraints (possibly pinning to oldest support versions of dependencies)
+rapids-generate-pip-constraints test_python "${PIP_CONSTRAINT}"
+
+# notes:
+#
+#   * echo to expand wildcard before adding `[test]` requires for pip
+#   * just providing --constraint="${PIP_CONSTRAINT}" to be explicit, and because
+#     that environment variable is ignored if any other --constraint are passed via the CLI
+#
+rapids-pip-retry install \
+  -v \
+  --prefer-binary \
+  --constraint "${PIP_CONSTRAINT}" \
   "$(echo "${LIBKVIKIO_WHEELHOUSE}"/libkvikio_"${RAPIDS_PY_CUDA_SUFFIX}"*.whl)" \
   "$(echo "${KVIKIO_WHEELHOUSE}"/kvikio_"${RAPIDS_PY_CUDA_SUFFIX}"*.whl)[test]"
 
diff --git a/dependencies.yaml b/dependencies.yaml
index 26a226dc79..e6ce9a6e59 100644
--- a/dependencies.yaml
+++ b/dependencies.yaml
@@ -176,6 +176,8 @@ dependencies:
       - output_types: [conda, requirements]
         packages:
           - pre-commit
+  # 'cuda_version' intentionally does not contain fallback entries... we want
+  # a loud error if an unsupported 'cuda' value is passed
   cuda_version:
     specific:
       - output_types: conda
@@ -204,6 +206,51 @@ dependencies:
               cuda: "13.1"
             packages:
               - cuda-version=13.1
+      - output_types: requirements
+        matrices:
+          # if use_cuda_wheels=false is provided, do not add dependencies on any CUDA wheels
+          # (e.g. for DLFW and pip devcontainers)
+          - matrix:
+              use_cuda_wheels: "false"
+            packages:
+          - matrix:
+              arch: aarch64
+              cuda: "12.2"
+              use_cuda_wheels: "true"
+            packages:
+              # some components (like nvidia-cublas-cu12 and nvidia-cuda-nvcc-cu12) didn't have
+              # aarch64 wheels until CTK 12.3, so allow a slightly looser bound here
+              - cuda-toolkit>=12.2,<12.4
+          - matrix:
+              cuda: "12.2"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==12.2.*
+          - matrix:
+              cuda: "12.5"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==12.5.*
+          - matrix:
+              cuda: "12.8"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==12.8.*
+          - matrix:
+              cuda: "12.9"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==12.9.*
+          - matrix:
+              cuda: "13.0"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==13.0.*
+          - matrix:
+              cuda: "13.1"
+              use_cuda_wheels: "true"
+            packages:
+              - cuda-toolkit==13.1.*
   cuda:
     common:
       - output_types: conda
@@ -337,9 +384,9 @@ dependencies:
           - pytest-timeout
           - rangehttpserver
           - boto3>=1.21.21
-      - output_types: [requirements, pyproject]
+      - output_types: pyproject
         packages:
-          - moto[server]>=4.0.8
+          - &moto_server moto[server]>=4.0.8
       - output_types: conda
         packages:
           - moto>=4.0.8
@@ -358,6 +405,17 @@ dependencies:
           - matrix:
             packages:
               - *cuda_python_cu13
+      # 'pip' constraints files cannot include extras like 'moto[server]'. This group
+      # ensures that dependencies ends up in 'kvikio[test]' ('dependencies' key not passed)
+      # but not in the output of 'rapids-generate-pip-constraints' in CI scripts ('dependencies' passed).
+      - output_types: requirements
+        matrices:
+          - matrix:
+              dependencies: "*"
+            packages:
+          - matrix:
+            packages:
+              - *moto_server
   test_java:
     common:
       - output_types: conda