diff --git a/.github/workflows/shared-run-e2e-tests.yaml b/.github/workflows/shared-run-e2e-tests.yaml
index 0277ce5a..79aaa621 100644
--- a/.github/workflows/shared-run-e2e-tests.yaml
+++ b/.github/workflows/shared-run-e2e-tests.yaml
@@ -76,6 +76,10 @@ on:
 env:
   REGISTRY: ghcr.io
 
+  # Last azure-cli built on Python 3.13; works around the Python 3.14 az deadlock
+  # (Azure/azure-cli#32869). Bump or remove once azure-cli supports Python 3.14.
+  AZURE_CLI_PINNED_VERSION: "2.87.0"
+
   E2E_UID2_INTEG_GCP_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_GCP_ARGS_JSON }}
   E2E_UID2_INTEG_AWS_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_AWS_ARGS_JSON }}
   E2E_UID2_INTEG_AZURE_ARGS_JSON: ${{ secrets.E2E_UID2_INTEG_AZURE_ARGS_JSON }}
@@ -204,6 +208,12 @@ jobs:
           target_environment: ${{ inputs.target_environment }}
           aws_pcr0: ${{ inputs.aws_pcr0 }}
 
+      - name: Pin Azure CLI (Azure/azure-cli#32869)
+        if: ${{ inputs.operator_type == 'aks' }}
+        uses: IABTechLab/uid2-shared-actions/actions/pin_azure_cli@v3
+        with:
+          azure_cli_version: ${{ env.AZURE_CLI_PINNED_VERSION }}
+
       - name: Start AKS cluster
         id: start_aks_cluster
         if: ${{ inputs.operator_type == 'aks' }}
@@ -404,6 +414,12 @@ jobs:
           aws_stack_name: ${{ needs.e2e-test.outputs.aws_stack_name }}
           aws_region: ${{ inputs.aws_region }}
 
+      - name: Pin Azure CLI (Azure/azure-cli#32869)
+        if: ${{ inputs.operator_type == 'aks' }}
+        uses: IABTechLab/uid2-shared-actions/actions/pin_azure_cli@v3
+        with:
+          azure_cli_version: ${{ env.AZURE_CLI_PINNED_VERSION }}
+
       - name: Stop AKS private operator
         if: ${{ inputs.operator_type == 'aks' }}
         uses: IABTechLab/uid2-shared-actions/actions/stop_aks_private_operator@v3
diff --git a/actions/pin_azure_cli/action.yaml b/actions/pin_azure_cli/action.yaml
new file mode 100644
index 00000000..f66f1f77
--- /dev/null
+++ b/actions/pin_azure_cli/action.yaml
@@ -0,0 +1,29 @@
+name: Pin Azure CLI
+description: >
+  Pin the runner's Azure CLI to a specific version via apt (downgrading if
+  needed), so az runs on the Python interpreter that version bundles. Works
+  around Azure/azure-cli#32869: on Python 3.14, msal's lazy `import requests` on
+  the CLI's long-running-operation poller thread deadlocks
+  (_frozen_importlib._DeadlockError) and crashes commands such as
+  `az network vnet create`, `az aks create`, and `az group delete`. Pin to a
+  build on Python <= 3.13 until upstream ships Python 3.14 support.
+
+inputs:
+  azure_cli_version:
+    description: azure-cli version to pin; that version's apt build is installed, e.g. "2.87.0".
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Pin azure-cli
+      shell: bash
+      env:
+        AZURE_CLI_VERSION: ${{ inputs.azure_cli_version }}
+      run: |
+        : "${AZURE_CLI_VERSION:?azure_cli_version input is required}"
+        # Idempotent: a no-op when az is already at the pinned version. The glob
+        # matches the -1~<dist> apt revision so it need not be spelled out.
+        pkg="azure-cli=${AZURE_CLI_VERSION}*"
+        sudo apt-get update
+        sudo apt-get install -y --allow-downgrades "${pkg}"