diff --git a/.ci/image/Dockerfile b/.ci/image/Dockerfile
index cb5d5d941..92cc33f60 100644
--- a/.ci/image/Dockerfile
+++ b/.ci/image/Dockerfile
@@ -65,12 +65,16 @@ FROM slim AS full
 ARG FLEDGE_CODENAME
 ARG APT_REPO_URL=https://packages.helinplatform.com/apt
 
+# plugins.txt: one "package=version" per line, optionally followed by "!<codename>" for each codename the
+# plugin is not built for (e.g. "fledge-filter-omfhint=3.1.0 !bullseye").
 COPY plugins.txt /tmp/plugins.txt
-RUN curl -fsSL "${APT_REPO_URL}/fledge.gpg" -o /usr/share/keyrings/fledge.gpg \
+RUN awk -v c="${FLEDGE_CODENAME}" '{ sub(/\r$/, ""); skip = 0; for (i = 2; i <= NF; i++) if ($i == "!" c) skip = 1; if (NF && !skip) print $1 }' \
+      /tmp/plugins.txt > /tmp/plugins.install \
+ && curl -fsSL "${APT_REPO_URL}/fledge.gpg" -o /usr/share/keyrings/fledge.gpg \
  && echo "deb [signed-by=/usr/share/keyrings/fledge.gpg] ${APT_REPO_URL} ${FLEDGE_CODENAME} main" \
       > /etc/apt/sources.list.d/fledge.list \
  && apt-get update \
  && apt-get install -y --no-install-recommends build-essential python3-dev \
- && xargs -a /tmp/plugins.txt apt-get install -y --no-install-recommends \
+ && xargs -a /tmp/plugins.install apt-get install -y --no-install-recommends \
  && apt-get purge -y --auto-remove build-essential python3-dev \
- && rm -rf /var/lib/apt/lists/* /root/.cache/pip /tmp/plugins.txt
+ && rm -rf /var/lib/apt/lists/* /root/.cache/pip /tmp/plugins.txt /tmp/plugins.install
diff --git a/.ci/image/README.md b/.ci/image/README.md
index f6cd6cb75..53ebfe4c8 100644
--- a/.ci/image/README.md
+++ b/.ci/image/README.md
@@ -9,7 +9,9 @@ container. `rsyslog.conf` and `rsyslog-rotate.sh` decide where logs go.
 
 `plugins.txt` is the authoritative list and the only place to change it. It holds
 28 entries, each pinned to an exact package version, and the `full` stage installs
-exactly those from the signed apt repository:
+exactly those from the signed apt repository. An entry can end with `!<codename>`
+(one per codename) to skip it on a distribution the plugin is not built for; for
+example, omfhint is marked `!bullseye`:
 
 - 15 filters: asset, change, delta, expression, fft, log, metadata, omfhint,
   python35, rate, rename, replace, rms, scale, threshold
diff --git a/.ci/image/plugins.txt b/.ci/image/plugins.txt
index 1415a0748..3616d17fb 100644
--- a/.ci/image/plugins.txt
+++ b/.ci/image/plugins.txt
@@ -5,7 +5,7 @@ fledge-filter-expression=3.1.0
 fledge-filter-fft=3.1.0
 fledge-filter-log=3.1.0
 fledge-filter-metadata=3.1.0
-fledge-filter-omfhint=3.1.0
+fledge-filter-omfhint=3.1.0 !bullseye
 fledge-filter-python35=3.1.0
 fledge-filter-rate=3.1.0
 fledge-filter-rename=3.1.0