diff --git a/cfsetup.yaml b/cfsetup.yaml
index be7dbe3c..e1c2853f 100644
--- a/cfsetup.yaml
+++ b/cfsetup.yaml
@@ -1,8 +1,9 @@
 pinned_go: &pinned_go go-boring=1.22.5-1
 
 build_dir: &build_dir /cfsetup_build
-default-flavor: bullseye
-buster: &buster
+default-flavor: bookworm
+
+bullseye: &bullseye
   build-linux:
     build_dir: *build_dir
     builddeps: &build_deps
@@ -31,8 +32,8 @@ buster: &buster
     builddeps: *build_deps
     pre-cache: *build_pre_cache
     post-cache:
-     - make cover
-  # except FIPS and macos 
+      - make cover
+  # except FIPS and macos
   build-linux-release:
     build_dir: *build_dir
     builddeps: &build_deps_release
@@ -47,10 +48,7 @@ buster: &buster
       - python3-setuptools
       - wget
     pre-cache: &build_release_pre_cache
-      - pip3 install pynacl==1.4.0
-      - pip3 install pygithub==1.55
-      - pip3 install boto3==1.22.9
-      - pip3 install python-gnupg==0.4.9
+      - python3 -m pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
     post-cache:
       # build all packages (except macos and FIPS) and move them to /cfsetup/built_artifacts
       - ./build-packages.sh
@@ -110,7 +108,7 @@ buster: &buster
       - export GOOS=linux
       - export GOARCH=arm64
       - export NIGHTLY=true
-      #- export FIPS=true # TUN-7595
+      # - export FIPS=true # TUN-7595
       - export ORIGINAL_NAME=true
       - make cloudflared-deb
   build-deb-arm64:
@@ -172,18 +170,20 @@ buster: &buster
     build_dir: *build_dir
     builddeps: &build_deps_component_test
       - *pinned_go
-      - python3.7
+      - python3
       - python3-pip
       - python3-setuptools
-      # procps installs the ps command which is needed in test_sysv_service because the init script
-      # uses ps pid to determine if the agent is running
+      # procps installs the ps command which is needed in test_sysv_service
+      # because the init script uses ps pid to determine if the agent is
+      # running
       - procps
     pre-cache-copy-paths:
       - component-tests/requirements.txt
     pre-cache: &component_test_pre_cache
-      - sudo pip3 install --upgrade -r component-tests/requirements.txt
+      - python3 -m pip install --break-system-packages --upgrade -r component-tests/requirements.txt
     post-cache: &component_test_post_cache
-      # Creates and routes a Named Tunnel for this build. Also constructs config file from env vars.
+      # Creates and routes a Named Tunnel for this build. Also constructs
+      # config file from env vars.
       - python3 component-tests/setup.py --type create
       - pytest component-tests -o log_cli=true --log-cli-level=INFO
       # The Named Tunnel is deleted and its route unprovisioned here.
@@ -205,8 +205,7 @@ buster: &buster
       - python3-setuptools
       - python3-pip
     pre-cache:
-      - pip3 install pynacl==1.4.0
-      - pip3 install pygithub==1.55
+      - python3 -m pip install pynacl==1.4.0 pygithub==1.55
     post-cache:
       - make github-release-dryrun
   github-release:
@@ -219,8 +218,7 @@ buster: &buster
       - python3-setuptools
       - python3-pip
     pre-cache:
-      - pip3 install pynacl==1.4.0
-      - pip3 install pygithub==1.55
+      - python3 -m pip install pynacl==1.4.0 pygithub==1.55
     post-cache:
       - make github-release
   r2-linux-release:
@@ -239,12 +237,9 @@ buster: &buster
       - reprepro
       - createrepo
     pre-cache:
-      - pip3 install pynacl==1.4.0
-      - pip3 install pygithub==1.55
-      - pip3 install boto3==1.22.9
-      - pip3 install python-gnupg==0.4.9
+      - python3 -m pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
     post-cache:
       - make r2-linux-release
 
-bullseye: *buster
-bookworm: *buster
+bookworm: *bullseye
+trixie: *bullseye