diff --git a/.github/actions/setup-python-uv/action.yml b/.github/actions/setup-python-uv/action.yml
index babe1b0..e3ef4a0 100644
--- a/.github/actions/setup-python-uv/action.yml
+++ b/.github/actions/setup-python-uv/action.yml
@@ -49,9 +49,12 @@ inputs:
 runs:
   using: composite
   steps:
-    # setup-uv publishes no floating major tag (only v8.x.y). The full commit SHA
-    # and readable release comment keep execution immutable and updates reviewable.
-    - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+    # setup-uv publishes no floating major tag (only vX.Y.Z — `v9` 404s upstream).
+    # The full commit SHA and readable release comment keep execution immutable and
+    # updates reviewable. The comment must name the exact version, never `# v9`:
+    # zizmor's ref-version-mismatch resolves it upstream and a float turns red on
+    # the next patch release.
+    - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
       with:
         enable-cache: true
     - name: Pin Python