diff --git a/cibuildwheel/resources/constraints-python312.txt b/cibuildwheel/resources/constraints-python312.txt
index 93c6a3db..d8f8591f 100644
--- a/cibuildwheel/resources/constraints-python312.txt
+++ b/cibuildwheel/resources/constraints-python312.txt
@@ -55,7 +55,8 @@ pefile==2024.8.26
     # via
     #   abi3audit
     #   delvewheel
-pip==26.1.2; implementation_name != "graalpy" or platform_system != "Windows"
+pip==26.1.2; implementation_name != "graalpy"
+pip==26.1.2; implementation_name == "graalpy" and platform_system != "Windows"
 pip==26.0.1; implementation_name == "graalpy" and platform_system == "Windows"
     # via -r cibuildwheel/resources/constraints.in
 pkgconf==3.0.1.post0
diff --git a/noxfile.py b/noxfile.py
index a4d46e7c..ecaa4417 100755
--- a/noxfile.py
+++ b/noxfile.py
@@ -70,18 +70,21 @@ def tests(session: nox.Session) -> None:
 # GraalPy (matching `graalpy_marker`) gets `held`, everything else
 # (`other_marker`) tracks the freshly compiled version.
 GRAALPY_HELD_BACK = (
-    # Newer pip breaks GraalPy on Windows.
+    # Newer pip breaks GraalPy on macOS and Windows.
     {
         "package": "pip",
-        "held": "26.0.1",
-        "graalpy_marker": 'implementation_name == "graalpy" and platform_system == "Windows"',
-        "other_marker": 'implementation_name != "graalpy" or platform_system != "Windows"',
+        "held": ("26.1.2", "26.0.1"),
+        "graalpy_marker": (
+            'implementation_name == "graalpy" and platform_system != "Windows"',
+            'implementation_name == "graalpy" and platform_system == "Windows"',
+        ),
+        "other_marker": 'implementation_name != "graalpy"',
     },
     # filelock >=3.30 imports errno.ENOTSUP, which GraalPy lacks (fix due ~2026-08).
     {
         "package": "filelock",
-        "held": "3.29.7",
-        "graalpy_marker": 'implementation_name == "graalpy"',
+        "held": ("3.29.7",),
+        "graalpy_marker": ('implementation_name == "graalpy"',),
         "other_marker": 'implementation_name != "graalpy"',
     },
 )
@@ -90,11 +93,15 @@ GRAALPY_HELD_BACK = (
 def _pin_graalpy_workarounds(output_file: Path) -> None:
     text = output_file.read_text()
     for pin in GRAALPY_HELD_BACK:
+        assert isinstance(pin["package"], str)
         package = re.escape(pin["package"])
+        graalpy_pins = "\n".join(
+            f"{pin['package']}=={pin['held'][i]}; {pin['graalpy_marker'][i]}"
+            for i in range(len(pin["held"]))
+        )
         text = re.sub(
             rf"^{package}==(?P<version>[^\s;]+)$",
-            f"{pin['package']}==\\g<version>; {pin['other_marker']}\n"
-            f"{pin['package']}=={pin['held']}; {pin['graalpy_marker']}",
+            f"{pin['package']}==\\g<version>; {pin['other_marker']}\n{graalpy_pins}",
             text,
             flags=re.MULTILINE,
         )