diff --git a/docker/Dockerfile.dev b/docker/Dockerfile.dev
index df31e072e7..2b9436711a 100644
--- a/docker/Dockerfile.dev
+++ b/docker/Dockerfile.dev
@@ -23,6 +23,11 @@ RUN sh /tmp/setup_compiler_wrappers.sh && rm /tmp/setup_compiler_wrappers.sh
 
 ENV PATH="/usr/local/bin/wrapped-cc:$PATH"
 
+# The lock in requirements-common_lock.txt is installed into this virtual
+# environment: the system Python is externally managed (PEP 668).
+ENV VIRTUAL_ENV=/opt/orfs-python
+ENV PATH="${VIRTUAL_ENV}/bin:$PATH"
+
 # The last rm drops the unused net-imap default gem bundled with Ubuntu 22.04's
 # Ruby 3.0 (flagged by CVE scanners, never used by the flow). It is chained here
 # so the files don't persist in an earlier layer. No-op if not present.
diff --git a/etc/DependencyInstaller.sh b/etc/DependencyInstaller.sh
index dc3cb17cb3..d98925a0a3 100755
--- a/etc/DependencyInstaller.sh
+++ b/etc/DependencyInstaller.sh
@@ -154,17 +154,21 @@ _installPipCommon() {
     local lockfile piplock
     lockfile="${_script_dir}/requirements-common_lock.txt"
     piplock="${_script_dir}/requirements-pip_lock.txt"
-    if [[ "$OSTYPE" == "darwin"* ]]; then
+    if [[ -n "${VIRTUAL_ENV:-}" ]]; then
+        # The lock goes into the virtual environment, created if it does
+        # not exist yet; the Docker images name one with ENV VIRTUAL_ENV.
+        if [[ ! -x "${VIRTUAL_ENV}/bin/python3" ]]; then
+            python3 -m venv "${VIRTUAL_ENV}"
+        fi
+        "${VIRTUAL_ENV}/bin/python3" -m pip install --no-cache-dir --upgrade --require-hashes -r "$piplock"
+        "${VIRTUAL_ENV}/bin/python3" -m pip install --no-cache-dir -r "$lockfile"
+    elif [[ "$OSTYPE" == "darwin"* ]]; then
         if [[ "$EUID" -eq 0 ]]; then
             echo "Error: Do NOT run with sudo."
             exit 1
         fi
-        if [[ -n "${VIRTUAL_ENV:-}" ]]; then
-            python3 -m pip install --no-cache-dir -r "$lockfile"
-        else
-            echo "Error: Activate a virtual environment on macOS."
-            exit 1
-        fi
+        echo "Error: Activate a virtual environment on macOS."
+        exit 1
     else
         # pip before 23.3 fails --require-hashes on requirements-common_lock.txt:
         # it does not match an extras-bearing pin such as
@@ -726,11 +730,22 @@ case "${os}" in
                     _installPipCommon
                 fi
             else
-                # Python packages come from apt (PEP 668), so they belong
-                # with the other system packages in -base.
+                # The system Python is externally managed (PEP 668): its
+                # packages come from apt, in -base with the other system
+                # packages. The lock, which also has packages apt does not
+                # carry, goes into a virtual environment when one is named.
                 if [[ "${option}" == "base" || "${option}" == "all" ]]; then
                     _installPipSystem
                 fi
+                if [[ "${option}" == "common" || "${option}" == "all" ]]; then
+                    if [[ -n "${VIRTUAL_ENV:-}" ]]; then
+                        _installPipCommon
+                    else
+                        echo "Python packages from apt only. For those in" \
+                            "etc/requirements-common_lock.txt that apt does" \
+                            "not carry, set VIRTUAL_ENV and run -common again."
+                    fi
+                fi
             fi
         else
             echo "Skip pip packages for rodete"