diff --git a/.github/workflows/bump-dev-version.yml b/.github/workflows/bump-dev-version.yml
index e1b8f50c7..d4cda5026 100644
--- a/.github/workflows/bump-dev-version.yml
+++ b/.github/workflows/bump-dev-version.yml
@@ -101,7 +101,7 @@ jobs:
           # The bump reads and rewrites the tip; no history is needed.
           fetch-depth: 1
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index a8896855a..0179acd9e 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -93,7 +93,7 @@ jobs:
       #  - the `uv tool install prek` step below.
       # Minimum uv version is pinned in the root `pyproject.toml`
       # (`[tool.uv] required-version`).
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the
diff --git a/.github/workflows/sandbox-lint.yml b/.github/workflows/sandbox-lint.yml
index 8c85b9fee..2c70b5ce4 100644
--- a/.github/workflows/sandbox-lint.yml
+++ b/.github/workflows/sandbox-lint.yml
@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the
diff --git a/.github/workflows/skill-and-tool-validator.yml b/.github/workflows/skill-and-tool-validator.yml
index ffb93ef5f..e2d90e5f8 100644
--- a/.github/workflows/skill-and-tool-validator.yml
+++ b/.github/workflows/skill-and-tool-validator.yml
@@ -47,7 +47,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the
diff --git a/.github/workflows/skill-token-count.yml b/.github/workflows/skill-token-count.yml
index 5688047a3..64f291e0e 100644
--- a/.github/workflows/skill-token-count.yml
+++ b/.github/workflows/skill-token-count.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 75971e338..f75fc2530 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -186,7 +186,7 @@ jobs:
       # `pyproject.toml` + the workspace `uv.lock`. Minimum uv
       # version is enforced by the root `pyproject.toml`'s
       # `[tool.uv] required-version`.
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # One slot per matrix leg, not merely per job: these run in parallel
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index f5fc34daa..c0e49efd6 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -51,7 +51,7 @@ jobs:
       # before zizmor was ever invoked. Installing the CLI from PyPI also
       # puts its version under the root lockfile and the
       # `[tool.uv] exclude-newer` cooldown, same as prek.
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
         with:
           enable-cache: true
         # A distinct cache slot per job. `setup-uv` derives its key from the