diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index bfd16ad9a6..abc3ae41ad 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -21,6 +21,11 @@ Next release
   ``json.JSONDecodeError`` in ``get_results_cache_data`` and returning an empty mapping.
   https://github.com/aboutcode-org/scancode-toolkit/issues/5345
 
+- Cap ``pluggy`` below 1.7.0. pluggy 1.7.0 no longer accepts the class-based
+  hookspecs used by ``plugincode`` and scancode fails at import time with
+  ``ValueError: did not find any 'pre_scan' hooks``.
+  https://github.com/aboutcode-org/scancode-toolkit/issues/5363
+
 v33.0.0rc1 - 2026-05-14
 ------------------------
 
diff --git a/pyproject-scancode-toolkit-mini.toml b/pyproject-scancode-toolkit-mini.toml
index b40f4d07fe..a5762e9c22 100644
--- a/pyproject-scancode-toolkit-mini.toml
+++ b/pyproject-scancode-toolkit-mini.toml
@@ -84,7 +84,7 @@ dependencies = [
     "pefile >= 2020.1.1",
     "pip-requirements-parser >= 32.0.1",
     "pkginfo2 >= 30.0.0",
-    "pluggy >= 1.0.0",
+    "pluggy >= 1.0.0, < 1.7.0",
     "plugincode >= 32.0.0",
     "publicsuffix2",
     "pyahocorasick >= 2.3.0",
diff --git a/pyproject-scancode-toolkit.toml b/pyproject-scancode-toolkit.toml
index 29f8157b8d..e481874b66 100644
--- a/pyproject-scancode-toolkit.toml
+++ b/pyproject-scancode-toolkit.toml
@@ -84,7 +84,7 @@ dependencies = [
     "pefile >= 2020.1.1",
     "pip-requirements-parser >= 32.0.1",
     "pkginfo2 >= 30.0.0",
-    "pluggy >= 1.0.0",
+    "pluggy >= 1.0.0, < 1.7.0",
     "plugincode >= 32.0.0",
     "publicsuffix2",
     "pyahocorasick >= 2.3.0",
diff --git a/pyproject.toml b/pyproject.toml
index 9893c3c585..31a5711823 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -85,7 +85,7 @@ dependencies = [
     "pefile >= 2020.1.1",
     "pip-requirements-parser >= 32.0.1",
     "pkginfo2 >= 30.0.0",
-    "pluggy >= 1.0.0",
+    "pluggy >= 1.0.0, < 1.7.0",
     "plugincode >= 32.0.0",
     "publicsuffix2",
     "pyahocorasick >= 2.3.0",