diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c7057f8..37afb99 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,7 +30,7 @@ jobs:
         shell: bash # Git Bash on Windows, so mv/pytest run the same everywhere
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv sync
       - run: uv run ruff check .
       # PySide6 links libEGL even under the offscreen QPA plugin the tests use,
diff --git a/.github/workflows/check-versions.yml b/.github/workflows/check-versions.yml
index 1901f45..f8fc451 100644
--- a/.github/workflows/check-versions.yml
+++ b/.github/workflows/check-versions.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - name: Probe vendor pages
         run: uv run --no-project --with requests python scripts/check_versions.py --json findings.json
       - name: File an issue per outdated tool
diff --git a/.github/workflows/sign-catalog.yml b/.github/workflows/sign-catalog.yml
index 1b9b824..87f7736 100644
--- a/.github/workflows/sign-catalog.yml
+++ b/.github/workflows/sign-catalog.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - name: Sign catalog.json
         env:
           UPDATE_SIGNING_KEY: ${{ secrets.UPDATE_SIGNING_KEY }}
diff --git a/.github/workflows/validate-catalog.yml b/.github/workflows/validate-catalog.yml
index 2440d61..b1a3afb 100644
--- a/.github/workflows/validate-catalog.yml
+++ b/.github/workflows/validate-catalog.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       - run: uv run --no-project --with jsonschema --with requests python scripts/validate_catalog.py --check-urls
       # a dead vendor link on the nightly run should page the maintainer via
       # an issue, not just fail red in a tab nobody watches