diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 137731a..c685d11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -184,7 +184,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       # Run the Python invariant suite, then regenerate the reference fixtures
       # and fail if the committed copies drifted. The Rust parity tests diff
       # against these files, so this is what stops the reference and the port
@@ -200,7 +200,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       # Deterministic gate for the review engine's own Python (the completeness layer:
       # the LLM reviewer is advisory, these checks are non-negotiable).
       - name: ruff (AI-review scripts)