diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index b6a04b1..1afbd8a 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -18,7 +18,7 @@ jobs:
       # deploy is the only other way to exercise them. The harness loads them out of the
       # YAML and runs them against a mock gh, so the tests cannot drift from the workflow.
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1   # full version: setup-uv uses immutable releases
+        uses: astral-sh/setup-uv@v10.3.3   # full version: setup-uv uses immutable releases
         with:
           enable-cache: false
       - name: Workflow gather-step tests
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 85bd1e4..1d20a0d 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -66,7 +66,7 @@ jobs:
       # python-version input it only puts uv on PATH, honouring a committed
       # .python-version if the project has one — a no-op for npx-only repos.
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1   # full version: setup-uv uses immutable releases (no floating @v8)
+        uses: astral-sh/setup-uv@v10.3.3   # full version: setup-uv uses immutable releases (no floating @v8)
         with:
           # No project deps to cache here: build-command owns dependency install
           # (npx/make/tox/uv) and there are no requirements/pyproject/uv.lock files to