diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7de6c4b..12e51aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
-      - uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - run: uv pip install --system pre-commit==4.2.0
       - run: pre-commit run --all-files --show-diff-on-failure --color=always
 
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.13'
-      - uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       - name: Install package and dev dependencies
         run: uv pip install --system -e ".[dev]"
       - name: Run tests
@@ -59,7 +59,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
       # No committed lock: `uv export` resolves one with the cooldown above, as users get it.
       - uses: ./
         with:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index efdda56..2cd8785 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -168,7 +168,7 @@ jobs:
 
       - name: Set up uv
         if: matrix.setup == 'uv'
-        uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
 
       - name: Generate uv.lock
         if: matrix.setup == 'uv'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 16f0f2f..39f4151 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,6 +27,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           persona: pedantic
diff --git a/action.yml b/action.yml
index 9101328..31ab671 100644
--- a/action.yml
+++ b/action.yml
@@ -52,7 +52,7 @@ runs:
     # No `python-version` here: it sets UV_PYTHON for the rest of the caller's job, overriding
     # their project's Python. The audit step passes --python instead.
     - name: Set up uv
-      uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
+      uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
 
     # Dependencies resolve fresh on every run but skip releases younger than the cooldown, the
     # window in which a hijacked PyPI release is usually caught. A flag, not UV_EXCLUDE_NEWER, so