diff --git a/changelog.d/12025.misc b/changelog.d/12025.misc
new file mode 100644
index 0000000000000000000000000000000000000000..d9475a7718817d471d8bfde68b3e99a4c2765b5b
--- /dev/null
+++ b/changelog.d/12025.misc
@@ -0,0 +1 @@
+Update the `olddeps` CI job to use an old version of `markupsafe`.
diff --git a/tox.ini b/tox.ini
index 2b3d39e0340fb3f5773c31fb446669db78a837c5..41678aa38bee093b76a7b0e01f3ab396b4143173 100644
--- a/tox.ini
+++ b/tox.ini
@@ -124,6 +124,9 @@ usedevelop = false
 deps =
     Automat == 0.8.0
     lxml
+    # markupsafe 2.1 introduced a change that breaks Jinja 2.x. Since we depend on
+    # Jinja >= 2.9, it means this test suite will fail if markupsafe >= 2.1 is installed.
+    markupsafe < 2.1
     {[base]deps}
 
 commands =