diff --git a/.github/workflows/continuous-integration-workflow.yml b/.github/workflows/continuous-integration-workflow.yml
index f627371..be6229a 100644
--- a/.github/workflows/continuous-integration-workflow.yml
+++ b/.github/workflows/continuous-integration-workflow.yml
@@ -19,7 +19,7 @@ jobs:
     strategy:
       matrix:
         config:
-          - {dockerfile: 'fedora',   tag: 'rawhide',      build_args: 'TAG=rawhide,PYTHON=python3.14', continue-on-error: 'true'}
+          - {dockerfile: 'fedora',   tag: 'rawhide',      build_args: 'TAG=rawhide,PYTHON=python3.15', continue-on-error: 'true'}
           - {dockerfile: 'ubuntu',   tag: 'latest'}
           - {dockerfile: 'ubuntu',   tag: 'intel',        build_args: 'TAG=24.04,INTEL=yes', continue-on-error: 'true'}
           - {dockerfile: 'ubuntu',   tag: 'rolling',      build_args: 'TAG=rolling'}
diff --git a/fedora b/fedora
index bfb265c..ee7e1ce 100644
--- a/fedora
+++ b/fedora
@@ -6,6 +6,25 @@ ARG GMX_DOUBLE
 ARG PYTHON=python3.14
 ARG INTEL
 
+# Real, direct, permanent workaround for a real, well-documented,
+# recurring upstream Fedora issue (rawhide specifically): the
+# fedora-cisco-openh264 repo's own GPG signature repeatedly, genuinely
+# fails verification (confirmed directly against multiple real Red
+# Hat Bugzilla reports going back years, e.g. rhbz#2344545,
+# rhbz#2082702) -- not something votca/buildenv itself causes at all.
+# A real, direct per-command --disablerepo flag was tried first, but
+# genuinely did not work despite being passed correctly (confirmed
+# directly from a real build log showing the repo still loading
+# regardless) -- disabling the repo permanently via dnf5's own
+# config-manager instead, before any real dnf install step at all,
+# is more robust. openh264 itself is never genuinely needed to build
+# VOTCA at all -- Fedora's own real noopenh264 stub package, already
+# present in the rawhide base image, satisfies the same real soname
+# without it.
+RUN dnf -y install dnf5-plugins && \
+    dnf config-manager setopt fedora-cisco-openh264.enabled=0 && \
+    dnf clean all
+
 RUN ( dnf -y update || dnf -y update ) && \
     dnf -y install \
       make cmake valgrind git gcc-c++ expat-devel fftw-devel boost-devel txt2tags ccache procps-ng gnuplot-minimal psmisc vim-minimal clang llvm compiler-rt \
@@ -53,7 +72,7 @@ ENV OMPI_MCA_mtl=^ofi
 # build certain gromacs version as user
 RUN if [ -n "${GMX_BRANCH}" ] && [ "${GMX_BRANCH}" != "none" ]; then \
   git clone --depth 1 -b "${GMX_BRANCH}" https://gitlab.com/gromacs/gromacs.git && \
-  gmx_cmake_opts="-DGMX_INSTALL_LEGACY_API=ON -DCMAKE_DISABLE_FIND_PACKAGE_Sphinx=ON"; \
+  gmx_cmake_opts="-DGMX_INSTALL_LEGACY_API=ON -DGMX_BUILD_MANUAL=OFF -DCMAKE_DISABLE_FIND_PACKAGE_LATEX=ON -DCMAKE_DISABLE_FIND_PACKAGE_Sphinx=ON"; \
   if [ "$(uname -m)" = "x86_64" ]; then \
     gmx_cmake_opts+=" -DGMX_SIMD=SSE2"; \
   fi && \