Puppet from bullseye fails to bootstrap against upgraded puppet server

I am trying to bootstrap a new host (for #41351 (closed)) and in our procedure, we install a pupept agent from bullseye because that seems to be the only way to bootstrap puppet to run against an older puppetmaster.

But now it seems that doesn't work anymore, possibly because of the recent upgrade of pauli from bookworm to bullseye (#40696 (closed)). I'm not exactly sure what's going on, but it fails at the first run with:

running puppet to generate certificate request checksum...
Info: Creating a new SSL key for ssh-dal-01.torproject.org
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for ssh-dal-01.torproject.org
Info: Certificate Request fingerprint (SHA256): C8:84:23:5F:55:D9:1A:ED:55:55:42:E6:C6:F3:DB:2A:F6:44:F0:B4:F1:3E:0B:78:CA:69:54:9D:FB:8D:5C:BC
Error: Could not request certificate: Error 500 on SERVER: Server Error: can't modify frozen String: ""
Exiting; failed to retrieve certificate and waitforcert is disabled
client certificate SHA-256 checksum:

sha256sum: ssh-dal-01.torproject.org.pem: No such file or directory

Normally, this step succeeds at least in creating a CSR on the Puppet server, but now the client just crashes that way... not sure what's going on...

/cc @lavamind