diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7c2675e..ca67a3d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: "3.13"
           # Distinguishes lint's cache key from pytest (py3.13)'s key —
@@ -39,7 +39,7 @@ jobs:
       # Runs the hooks from .pre-commit-config.yaml rather than repeating them
       # here, so local and CI cannot drift apart. zizmor is skipped: it has its
       # own job below, which the ruleset requires by name.
-      - uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece  # v3.0.0
+      - uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204  # v3.0.1
         with:
           prek-version: 0.4.13
         env:
@@ -57,7 +57,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv sync --group dev --locked
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ed2459d..d82cc6f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -166,7 +166,7 @@ jobs:
           # API below -- so the App token has no reason to persist in .git/config.
           persist-credentials: false
       - if: steps.pr_branch.outputs.branch != ''
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
           python-version: "3.13"
           enable-cache: false