diff --git a/.github/workflows/action-pin-sweep.yml b/.github/workflows/action-pin-sweep.yml
index 26f5ea3..e7477ec 100644
--- a/.github/workflows/action-pin-sweep.yml
+++ b/.github/workflows/action-pin-sweep.yml
@@ -58,7 +58,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
       - run: uv sync --locked --extra dev
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f28b808..2fee98c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
 
@@ -80,7 +80,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       # Installs the pinned openadapt-flow release from PyPI in a throwaway
       # environment and compares its parser with the committed snapshot that
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       # Installs exactly the releases in cli-reference/requirements.txt in a
       # throwaway environment, regenerates docs/reference/cli-help.md and the
diff --git a/.github/workflows/default-branch-sweep.yml b/.github/workflows/default-branch-sweep.yml
index 7bf28d7..1f31ce8 100644
--- a/.github/workflows/default-branch-sweep.yml
+++ b/.github/workflows/default-branch-sweep.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
       - run: uv sync --locked --extra dev
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index d3d6272..a5a6776 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
 
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 6df8c91..e6d4d88 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           token: ${{ steps.app_token.outputs.token || github.token }}
 
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
 
diff --git a/.github/workflows/workspace-staleness-sweep.yml b/.github/workflows/workspace-staleness-sweep.yml
index 0f8949d..7974a22 100644
--- a/.github/workflows/workspace-staleness-sweep.yml
+++ b/.github/workflows/workspace-staleness-sweep.yml
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
         with:
           enable-cache: true
       - run: uv sync --locked --extra dev