diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 20b77765..ac598efe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     defaults: { run: { working-directory: detector } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -40,7 +40,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -53,7 +53,7 @@ jobs:
     defaults: { run: { working-directory: fleet } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -67,7 +67,7 @@ jobs:
     defaults: { run: { working-directory: detector } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run python -c 'from kitsune_detector.contracts import load_rule_registry; load_rule_registry(); print("contracts ok")'
@@ -77,7 +77,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       # The drift gate that already runs in local `task ci` — fail PRs that change the registry/corpus
@@ -169,7 +169,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with: { enable-cache: true }
       - run: uv sync
       - name: spine smoke — vanilla scores human, naive-bot scores bot