diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 459579c..ac57947 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,7 +21,7 @@ jobs:
           cache: true
           cache-dependency-path: '**/packages.lock.json'
       - name: dotnet restore
-        run: dotnet restore --locked-mode
+        run: dotnet restore --locked-mode /p:BuildWithNetFrameworkHostedCompiler=true
       - name: dotnet format
         run: dotnet format --verify-no-changes --no-restore
 
@@ -75,7 +75,7 @@ jobs:
           cache: true
           cache-dependency-path: '**/packages.lock.json'
       - name: dotnet restore
-        run: dotnet restore --locked-mode
+        run: dotnet restore --locked-mode /p:BuildWithNetFrameworkHostedCompiler=true
       # This doesn't call `dotnet publish` on the entire solution, just the
       # projects we care about building. Doing a full publish includes test
       # libraries and stuff which is pointless.
diff --git a/scripts/Publish.ps1 b/scripts/Publish.ps1
index ee86980..6c0c101 100644
--- a/scripts/Publish.ps1
+++ b/scripts/Publish.ps1
@@ -113,7 +113,7 @@ if (Test-Path $buildPath) {
 New-Item -ItemType Directory -Path $buildPath -Force
 
 # Build in release mode
-& dotnet.exe restore
+& dotnet.exe restore /p:BuildWithNetFrameworkHostedCompiler=true
 if ($LASTEXITCODE -ne 0) { throw "Failed to dotnet restore" }
 $servicePublishDir = Join-Path $buildPath "service"
 & dotnet.exe publish .\Vpn.Service\Vpn.Service.csproj -c Release -a $arch -o $servicePublishDir /p:Version=$version