diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 211fa64..bbceb8b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       # ref, so the short form fails the run outright with "unable to find
       # version". Bump this deliberately. (actions/checkout does still publish
       # `v7`, which is why that one differs.)
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -60,7 +60,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
           enable-cache: true
           python-version: "3.13"
@@ -88,7 +88,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
           enable-cache: true
           python-version: "3.13"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92d3675..0b8a165 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           fetch-depth: 0 # the changelog step reads the whole file, not the diff
 
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.2
         with:
           enable-cache: true
           python-version: "3.13"
@@ -95,7 +95,7 @@ jobs:
   #     id-token: write            # PyPI trusted publishing — no API token
   #   steps:
   #     - uses: actions/checkout@v7
-  #     - uses: astral-sh/setup-uv@v10.2.0
+  #     - uses: astral-sh/setup-uv@v10.3.2
   #     - run: uv build
   #     - run: uv publish          # resolves OIDC credentials automatically
   # ---------------------------------------------------------------------------