diff --git a/.semaphore/vms/vm-bootstrap.sh b/.semaphore/vms/vm-bootstrap.sh
index 891ef255f9d..80f2a506181 100644
--- a/.semaphore/vms/vm-bootstrap.sh
+++ b/.semaphore/vms/vm-bootstrap.sh
@@ -52,8 +52,12 @@ EOF
 
 # Pin the docker version; the node tests use an older docker client so we can't
 # let it float.
+buildx_version=""
 if [ "$ubuntu_codename" = "jammy" ]; then
   docker_version="=5:20.10.14~3-0~ubuntu-jammy"
+  # Need to pin because download.docker.com now has a newer buildx that tries to use an API version
+  # that is too new for the Docker daemon.
+  buildx_version="=0.29.0-0~ubuntu.22.04~jammy"
 elif [ "$ubuntu_codename" = "noble" ]; then
   docker_version="=5:27.5.1-1~ubuntu.24.04~noble"
 elif [ "$ubuntu_codename" = "plucky" ]; then
@@ -63,7 +67,7 @@ else
 fi
 
 retry apt-get update -y
-retry apt-get install -y --no-install-recommends git docker-ce"${docker_version}" docker-ce-cli"${docker_version}" docker-buildx-plugin containerd.io make iproute2 wireguard
+retry apt-get install -y --no-install-recommends git docker-ce"${docker_version}" docker-ce-cli"${docker_version}" docker-buildx-plugin"${buildx_version}" containerd.io make iproute2 wireguard
 usermod -a -G docker ubuntu
 
 # The IPIP module is loaded on demand, but pre-loading it prevents flakes in