diff --git a/deploy/Dockerfile.control-plane b/deploy/Dockerfile.control-plane
index 53bd99f..1a61241 100644
--- a/deploy/Dockerfile.control-plane
+++ b/deploy/Dockerfile.control-plane
@@ -1,4 +1,4 @@
-FROM ghcr.io/astral-sh/uv:0.12.17 AS uv
+FROM ghcr.io/astral-sh/uv:0.12.23 AS uv
 
 FROM node:22.23.2-bookworm-slim AS web
 
diff --git a/deploy/Dockerfile.node b/deploy/Dockerfile.node
index f115465..101c173 100644
--- a/deploy/Dockerfile.node
+++ b/deploy/Dockerfile.node
@@ -1,4 +1,4 @@
-FROM ghcr.io/astral-sh/uv:0.12.17 AS uv
+FROM ghcr.io/astral-sh/uv:0.12.23 AS uv
 
 FROM python:3.12.11-slim-bookworm AS python-wheels
 
diff --git a/deploy/Dockerfile.tauri-linux-ci b/deploy/Dockerfile.tauri-linux-ci
index c2381e5..95dfc50 100644
--- a/deploy/Dockerfile.tauri-linux-ci
+++ b/deploy/Dockerfile.tauri-linux-ci
@@ -1,4 +1,4 @@
-FROM rust:1.97-bookworm
+FROM rust:1.98-bookworm
 
 RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
diff --git a/tests/test_client_workspace_contract.py b/tests/test_client_workspace_contract.py
index 08df217..bebc862 100644
--- a/tests/test_client_workspace_contract.py
+++ b/tests/test_client_workspace_contract.py
@@ -17,14 +17,14 @@ def _client_production_files() -> list[Path]:
         ROOT / "packages/client-core/src",
         ROOT / "packages/client-ui/src",
     )
-    return [
+    return sorted(
         path
         for root in roots
         for path in root.rglob("*")
         if path.suffix in {".ts", ".vue"}
         and not path.name.endswith(".test.ts")
         and "test" not in path.relative_to(root).parts
-    ]
+    )
 
 
 def test_python_dependencies_come_from_portable_public_pypi_only() -> None:
@@ -135,14 +135,14 @@ def test_client_workspace_boundaries_and_platform_abstraction() -> None:
     ):
         assert forbidden not in core_source
 
-    storage_references = [
+    storage_references = sorted(
         path.relative_to(ROOT).as_posix()
         for path in _client_production_files()
         if any(
             token in path.read_text().lower()
             for token in ("localstorage", "sessionstorage", "indexeddb")
         )
-    ]
+    )
     assert storage_references == [
         "apps/clients/web/src/adapters/browserAgentCursorStore.ts",
         "apps/clients/web/src/adapters/browserThemePreferences.ts",