diff --git a/.github/workflows/bump.yaml b/.github/workflows/bump.yaml
index 7d0570c..d490638 100644
--- a/.github/workflows/bump.yaml
+++ b/.github/workflows/bump.yaml
@@ -22,7 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
         with:
           enable-cache: false  # Avoid cache poisoning.
       - name: Bump package version
diff --git a/.github/workflows/command-ref.yaml b/.github/workflows/command-ref.yaml
index 71cc47d..139d6c5 100644
--- a/.github/workflows/command-ref.yaml
+++ b/.github/workflows/command-ref.yaml
@@ -16,6 +16,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Check the command reference
         run: uvx --from rust-just@1.59.0 just command-ref
diff --git a/.github/workflows/deps.yaml b/.github/workflows/deps.yaml
index 484c41f..68b1218 100644
--- a/.github/workflows/deps.yaml
+++ b/.github/workflows/deps.yaml
@@ -18,6 +18,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Check uv.lock
         run: uv lock --check
diff --git a/.github/workflows/functional-full.yaml b/.github/workflows/functional-full.yaml
index 8211298..9fa36ba 100644
--- a/.github/workflows/functional-full.yaml
+++ b/.github/workflows/functional-full.yaml
@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Run functional tests
         env:
           UV_PYTHON: ${{ matrix.python-version }}
diff --git a/.github/workflows/functional-limited.yaml b/.github/workflows/functional-limited.yaml
index 5ce57dd..826dab1 100644
--- a/.github/workflows/functional-limited.yaml
+++ b/.github/workflows/functional-limited.yaml
@@ -13,7 +13,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Run functional tests
         env:
           UV_PYTHON: '3.11'
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 162fc4c..e6a7aa5 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -16,6 +16,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Lint the code
         run: uvx --from rust-just@1.59.0 just lint
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 004c7ce..a36d0f3 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -20,7 +20,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
         with:
           enable-cache: false  # Avoid cache poisoning.
       - name: Build package
@@ -30,7 +30,7 @@ jobs:
         with:
           subject-path: "dist/*"
       - name: Publish package
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   start-next-dev:
     runs-on: ubuntu-latest
@@ -43,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
         with:
           enable-cache: false  # Avoid cache poisoning.
       - name: Bump package version
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 509fb04..87fd35f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Check version
         id: check
         env:
@@ -90,7 +90,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Create draft release
         id: draft
         env:
diff --git a/.github/workflows/unit.yaml b/.github/workflows/unit.yaml
index 32d99d3..f8406ac 100644
--- a/.github/workflows/unit.yaml
+++ b/.github/workflows/unit.yaml
@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Run unit tests
         env:
           UV_PYTHON: ${{ matrix.python-version }}
diff --git a/.github/workflows/uvx.yaml b/.github/workflows/uvx.yaml
index 1ae6548..c3c736a 100644
--- a/.github/workflows/uvx.yaml
+++ b/.github/workflows/uvx.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Run gimmegit
         run: |
           set -x
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 3a75f15..3916169 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -18,13 +18,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e  # v10.3.2
       - name: Run zizmor
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Avoid rate limits for zizmor's "online" checks.
         run: uv run zizmor --format=sarif . > workflows.sarif
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           sarif_file: workflows.sarif
           category: zizmor