diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a92d9d9cac81..94e950acae301 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -188,6 +188,9 @@ jobs:
       - uses: actions/checkout@v6
       - run: brew uninstall cmake # conflict with install command below
       - run: brew install --quiet $(env HOMEBREW_NO_ENV_HINTS=1 brew deps --include-build qemu) bison flex
+      - run: |
+          echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"
+          echo "$(brew --prefix flex)/bin" >> "$GITHUB_PATH"
       - run: ./configure ${{ env.QEMU_WERROR }} && ninja -C build
       - run: ./build/qemu-system-x86_64-unsigned -nographic -plugin ./build/contrib/plugins/libstoptrigger,icount=1000000 -plugin ./build/tests/tcg/plugins/libinsn -plugin ./build/contrib/plugins/libcpp -d plugin
 
@@ -327,10 +330,11 @@ jobs:
       - run: sudo rm -rf /opt/ /usr/local/.ghcup /usr/local/lib/android
       - uses: actions/checkout@v6
       # bypass package signature check by faking sqv binary
+      # Documentation is covered elsewhere; keep this a compiler-only build.
       - run: >
           podman run --pull newer --init --rm -it -v $(pwd):$(pwd) -w $(pwd)
           docker.io/pboqemu/qemu-ci:debian
-          bash -cx 'cp /usr/bin/echo /usr/bin/sqv && LLVM_VERSION=22 && apt update && apt install -y lsb-release wget gnupg && wget https://apt.llvm.org/llvm.sh && bash llvm.sh ${LLVM_VERSION} && ./configure ${{ env.QEMU_WERROR }} --cxx=clang++-${LLVM_VERSION} --cc=clang-${LLVM_VERSION} --host-cc=clang-${LLVM_VERSION} --enable-debug && ninja -C build install'
+          bash -cx 'cp /usr/bin/echo /usr/bin/sqv && LLVM_VERSION=22 && apt update && apt install -y lsb-release wget gnupg && wget https://apt.llvm.org/llvm.sh && bash llvm.sh ${LLVM_VERSION} && ./configure ${{ env.QEMU_WERROR }} --disable-docs --cxx=clang++-${LLVM_VERSION} --cc=clang-${LLVM_VERSION} --host-cc=clang-${LLVM_VERSION} --enable-debug && ninja -C build install'
 
   build-kvm-only:
     needs: checkapply
diff --git a/tests/qtest/ax650x-pyramid-test.c b/tests/qtest/ax650x-pyramid-test.c
index 3043d03c8d28e..b583e78195460 100644
--- a/tests/qtest/ax650x-pyramid-test.c
+++ b/tests/qtest/ax650x-pyramid-test.c
@@ -504,9 +504,10 @@ static void test_emmc_block_io_and_irq(void)
         source[i] = i % 127 + 1;
         written[i] = (i * 3) % 127 + 1;
     }
-    fd = open(emmc_path, O_WRONLY);
+    fd = open(emmc_path, O_WRONLY | O_BINARY);
     g_assert_cmpint(fd, >=, 0);
-    ret = pwrite(fd, source, sizeof(source), 0);
+    g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+    ret = qemu_write_full(fd, source, sizeof(source));
     g_assert_cmpint(ret, ==, sizeof(source));
     close(fd);
 
@@ -529,9 +530,10 @@ static void test_emmc_block_io_and_irq(void)
                     sizeof(written), AX650X_EMMC_BLOCK_SIZE);
     qtest_quit(qts);
 
-    fd = open(emmc_path, O_RDONLY);
+    fd = open(emmc_path, O_RDONLY | O_BINARY);
     g_assert_cmpint(fd, >=, 0);
-    ret = pread(fd, readback, sizeof(readback), 0);
+    g_assert_cmpint(lseek(fd, 0, SEEK_SET), ==, 0);
+    ret = read(fd, readback, sizeof(readback));
     g_assert_cmpint(ret, ==, sizeof(readback));
     close(fd);
     g_assert_cmpmem(readback, sizeof(readback), written, sizeof(written));
@@ -570,9 +572,11 @@ static void test_emmc_auto_cmd23(void)
                     SDHC_R1_STATE_TRAN);
     qtest_quit(qts);
 
-    fd = open(emmc_path, O_RDONLY);
+    fd = open(emmc_path, O_RDONLY | O_BINARY);
     g_assert_cmpint(fd, >=, 0);
-    ret = pread(fd, readback, sizeof(readback), AX650X_EMMC_BLOCK_SIZE);
+    g_assert_cmpint(lseek(fd, AX650X_EMMC_BLOCK_SIZE, SEEK_SET), ==,
+                    AX650X_EMMC_BLOCK_SIZE);
+    ret = read(fd, readback, sizeof(readback));
     g_assert_cmpint(ret, ==, sizeof(readback));
     close(fd);
     g_assert_cmpmem(readback, sizeof(readback), expected, sizeof(expected));
diff --git a/tests/qtest/virtio-9p-test.c b/tests/qtest/virtio-9p-test.c
index cfd3c02da4510..ab879f4ba7eab 100644
--- a/tests/qtest/virtio-9p-test.c
+++ b/tests/qtest/virtio-9p-test.c
@@ -38,11 +38,11 @@
 /*
  * xattr size to be used for xattr tests
  *
- * 64k is the max. xattr size supported by the Linux kernel, However btrfs
- * for instance supports only 16219 bytes. So let's be conservative and
- * just use 8k for the xattr tests.
+ * The filesystem backing the local 9p export may impose a much smaller limit
+ * than the Linux VFS, especially when tests run on overlay filesystems. The
+ * xattr FID limit tests only require a non-empty value, so keep it small.
  */
-#define TEST_XATTR_SIZE (8 * 1024)
+#define TEST_XATTR_SIZE 1024
 
 static void pci_config(void *obj, void *data, QGuestAllocator *t_alloc)
 {