diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d7c56a8..ea927de 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -176,7 +176,7 @@ jobs:
           # `origin/<base>...HEAD` — the default shallow checkout lacks the
           # merge base on most PRs.
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@v8.1.0
       - name: Set up Python
         run: uv python install 3.14
       - name: Ruff lint
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 8ff46dc..e9d9492 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@v8.1.0
       # Default persona + the project's .github/zizmor.yml (ref-pin policy)
       # — we track action versions via Dependabot's github-actions ecosystem
       # rather than SHA pinning.