diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 8b2168c..1e3071f 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |
@@ -78,7 +78,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |
diff --git a/.github/workflows/validate-terraform.yml b/.github/workflows/validate-terraform.yml
index a99f3fa..ac00e40 100644
--- a/.github/workflows/validate-terraform.yml
+++ b/.github/workflows/validate-terraform.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Install OpenTofu
         uses: opentofu/setup-opentofu@v2
         with:
-          tofu_version: 1.10.10
+          tofu_version: 1.9.0
 
       - name: Install SOPS
         run: |
diff --git a/terraform/providers.tf b/terraform/providers.tf
index 516865f..3260ffe 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.10.0"
+  required_version = ">= 1.6.0"
 
   required_providers {
     hcloud = {
@@ -24,7 +24,10 @@ terraform {
     region                      = "eu-central-003"
     skip_credentials_validation = true
     skip_region_validation      = true
-    use_lockfile                = true
+    # NOTE: no state locking — Backblaze B2's S3 API doesn't implement the
+    # conditional PutObject that OpenTofu's use_lockfile needs (returns 501
+    # NotImplemented). Concurrent applies are instead prevented by the
+    # `concurrency` guard in .github/workflows/terraform.yml.
     # Credentials read from AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars
   }
 }