diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93fb92bf..a18b3cc1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     defaults: { run: { working-directory: detector } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -40,7 +40,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -53,7 +53,7 @@ jobs:
     defaults: { run: { working-directory: fleet } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run ruff check .
@@ -67,7 +67,7 @@ jobs:
     defaults: { run: { working-directory: detector } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       - run: uv run python -c 'from kitsune_detector.contracts import load_rule_registry; load_rule_registry(); print("contracts ok")'
@@ -77,7 +77,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       # The drift gate that already runs in local `task ci` — fail PRs that change the registry/corpus
@@ -171,7 +171,7 @@ jobs:
     defaults: { run: { working-directory: harness } }
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with: { enable-cache: true }
       - run: uv sync
       - name: spine smoke — vanilla scores human, naive-bot scores bot