diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 55c113e..6c8a864 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v10.3.2
+      - uses: astral-sh/setup-uv@v10.3.3
       - uses: extractions/setup-just@v4
       # Fail fast if uv.lock has drifted from pyproject.toml.
       - run: uv lock --locked
@@ -33,7 +33,7 @@ jobs:
           - "3.14"
     steps:
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v10.3.2
+      - uses: astral-sh/setup-uv@v10.3.3
         with:
           python-version: ${{ matrix.python-version }}
       - uses: extractions/setup-just@v4
@@ -46,7 +46,7 @@ jobs:
         # hatch-vcs reads the version from the tags, so fetch them.
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v10.3.2
+      - uses: astral-sh/setup-uv@v10.3.3
       - uses: extractions/setup-just@v4
       - run: just build
       - run: just smoke
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 623e7ef..e3823d5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v10.3.2
+      - uses: astral-sh/setup-uv@v10.3.3
       - uses: extractions/setup-just@v4
       # The tag is the only source of the version, so this only guards against a
       # build that did not pick the tag up (shallow clone, dirty tree, two tags on