diff --git a/.github/workflows/canonical-verification.yml b/.github/workflows/canonical-verification.yml
index a474b2698..fa84ece25 100644
--- a/.github/workflows/canonical-verification.yml
+++ b/.github/workflows/canonical-verification.yml
@@ -74,7 +74,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
 
       - name: Restore pinned Isabelle archive
         # Untrusted PR and manual-release refs may consume this cache but must
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 84d8192b8..4bac7e3b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,7 +55,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Run fuzz session
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s fuzz
 
@@ -76,7 +76,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Test exact interpreter and clean distribution
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s python-compatibility
 
@@ -92,7 +92,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Probe for a container runtime
         id: runtime
         run: |
@@ -118,7 +118,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Run OSV-scanner (gating)
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s osv_scan
       - name: Upload OSV-scanner report
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ea39924ff..8e42e8e7f 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -28,7 +28,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Validate and build public docs
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s docs-local
       - name: Check external documentation links
@@ -52,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/python-free-threaded-preview.yml b/.github/workflows/python-free-threaded-preview.yml
index 6fad0bed2..2c5b654f1 100644
--- a/.github/workflows/python-free-threaded-preview.yml
+++ b/.github/workflows/python-free-threaded-preview.yml
@@ -24,6 +24,6 @@ jobs:
         with:
           python-version: 3.14t
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
       - name: Test preview interpreter and clean distribution
         run: uv tool run --from 'nox[uv]==2026.4.10' nox -f noxfile.py -s python-compatibility
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 9ba3e6e53..81b552905 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -207,7 +207,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
 
       - name: Require real-container release integration
         env:
@@ -264,7 +264,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v8
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v8
 
       - name: Build the corpus-bundled wheel + sdist
         run: uv build --out-dir dist implementations/python
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 96eff85ef..fca91cc57 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,7 @@ jobs:
       id-token: write
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
         with:
           egress-policy: audit
 
@@ -47,6 +47,6 @@ jobs:
 
       - name: Upload Scorecard results to code scanning
         if: ${{ always() }}
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif
diff --git a/implementations/python/tests/test_pr_body_guard.py b/implementations/python/tests/test_pr_body_guard.py
index cf9d890eb..0b18c87e1 100644
--- a/implementations/python/tests/test_pr_body_guard.py
+++ b/implementations/python/tests/test_pr_body_guard.py
@@ -259,7 +259,10 @@ def test_report_mode_recognizes_no_issue_declaration() -> None:
     assert "declared that no issue was required" in report
 
 
-def test_cli_rejects_missing_or_malformed_events(tmp_path: Path, capsys: pytest.CaptureFixture[str]) -> None:
+def test_cli_rejects_missing_or_malformed_events(
+    tmp_path: Path, capsys: pytest.CaptureFixture[str], monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.delenv("GITHUB_EVENT_PATH", raising=False)
     assert main([]) == 2
     assert main(["--event-path", str(tmp_path / "missing.json")]) == 2
     malformed = tmp_path / "event.json"