diff --git a/.github/workflows/benchmark-multinode-tmpl.yml b/.github/workflows/benchmark-multinode-tmpl.yml
index 257ac01aaf..4e4acad789 100644
--- a/.github/workflows/benchmark-multinode-tmpl.yml
+++ b/.github/workflows/benchmark-multinode-tmpl.yml
@@ -261,7 +261,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/benchmark-tmpl.yml b/.github/workflows/benchmark-tmpl.yml
index 0a3e0c100b..495271ee66 100644
--- a/.github/workflows/benchmark-tmpl.yml
+++ b/.github/workflows/benchmark-tmpl.yml
@@ -218,7 +218,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8e7e99901e..42ae59b6be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           working-directory: inferencex-e2e
           cache-suffix: ${{ matrix.check }}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d0667bf866..12c1b845a0 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -42,7 +42,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Install Claude Code 2.1.282
         id: claude_cli
@@ -53,7 +53,7 @@ jobs:
           echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
         env:
           # Repository agent credential; the pinned action authorizes the triggering actor.
           GH_TOKEN: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env]
@@ -313,7 +313,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Install Claude Code 2.1.282
         id: claude_cli
@@ -323,7 +323,7 @@ jobs:
           test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
           echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
       - name: PR Review with Claude
-        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
         with:
           path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
           # Repository review credential; the job gates eligible review requests.
diff --git a/.github/workflows/codeowner-signoff-verify.yml b/.github/workflows/codeowner-signoff-verify.yml
index bf4c6ea188..62a1551540 100644
--- a/.github/workflows/codeowner-signoff-verify.yml
+++ b/.github/workflows/codeowner-signoff-verify.yml
@@ -71,7 +71,7 @@ jobs:
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-dependency-glob: |
             pyproject.toml
@@ -122,7 +122,7 @@ jobs:
       - name: Verify sign-off with Claude
         id: claude
         if: steps.resolve.outputs.proceed == 'true'
-        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
         env:
           # Read-only job token: the agent reads untrusted PR content and never publishes.
           GH_TOKEN: ${{ github.token }}
@@ -207,7 +207,7 @@ jobs:
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-dependency-glob: |
             pyproject.toml
diff --git a/.github/workflows/collect-evals.yml b/.github/workflows/collect-evals.yml
index 3b3512a64c..55e081f902 100644
--- a/.github/workflows/collect-evals.yml
+++ b/.github/workflows/collect-evals.yml
@@ -41,7 +41,7 @@ jobs:
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-dependency-glob: |
             pyproject.toml
diff --git a/.github/workflows/collect-results.yml b/.github/workflows/collect-results.yml
index d7868d26f4..f12888da9c 100644
--- a/.github/workflows/collect-results.yml
+++ b/.github/workflows/collect-results.yml
@@ -42,7 +42,7 @@ jobs:
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-dependency-glob: |
             pyproject.toml
diff --git a/.github/workflows/collectivex-sweep.yml b/.github/workflows/collectivex-sweep.yml
index 89ca1c9304..efa410a0f8 100644
--- a/.github/workflows/collectivex-sweep.yml
+++ b/.github/workflows/collectivex-sweep.yml
@@ -64,7 +64,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { clean: true, persist-credentials: false }
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - id: score
         run: |
           scored=$(printf '%s' '[{"runner":"collectivex","framework":"collectivex"}]' |
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 1ad5121caa..7aae3a8b20 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -239,7 +239,7 @@ jobs:
                 path: .ci-priority
                 persist-credentials: false
 
-            - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+            - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
             - id: get-jobs
               env:
                   GENERATE_COMMAND: ${{ inputs.generate-cli-command || github.event.inputs.generate-cli-command }}
@@ -593,7 +593,7 @@ jobs:
                 echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
             - name: Set up uv
-              uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
               with:
                   cache-dependency-glob: |
                       pyproject.toml
diff --git a/.github/workflows/klaud-candidate.yml b/.github/workflows/klaud-candidate.yml
index a177a9b064..d1b0e8b1cc 100644
--- a/.github/workflows/klaud-candidate.yml
+++ b/.github/workflows/klaud-candidate.yml
@@ -52,7 +52,7 @@ jobs:
           fi
           test -f "$python_project/pyproject.toml"
           echo "INFERENCEX_TOOLING_PROJECT=$python_project" >> "$GITHUB_ENV"
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           python-version: '3.12'
           cache-dependency-glob: |
@@ -85,7 +85,7 @@ jobs:
       - name: Let Klaud Cold own the candidate PR
         id: claude
         continue-on-error: true
-        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
         env:
           GH_TOKEN: ${{ secrets.AGENT_PAT }}
           KLAUD_DASHBOARD_API_KEY: ${{ secrets.DASH_API_KEY }}
diff --git a/.github/workflows/klaud-plan.yml b/.github/workflows/klaud-plan.yml
index de23aad012..1e6e00660e 100644
--- a/.github/workflows/klaud-plan.yml
+++ b/.github/workflows/klaud-plan.yml
@@ -54,7 +54,7 @@ jobs:
           fi
           test -f "$python_project/pyproject.toml"
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           python-version: '3.12'
           cache-dependency-glob: |
@@ -102,7 +102,7 @@ jobs:
           fi
           test -f "$python_project/pyproject.toml"
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           # Never save a cache the agent's job could have poisoned for credentialed jobs to restore.
           enable-cache: false
@@ -143,7 +143,7 @@ jobs:
         id: review
         if: steps.prepare.outputs.has_candidates == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
         env:
           GH_TOKEN: ${{ github.token }}
           KLAUD_EVIDENCE: ${{ runner.temp }}/klaud
@@ -243,7 +243,7 @@ jobs:
           fi
           test -f "$python_project/pyproject.toml"
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           python-version: '3.12'
           cache-dependency-glob: |
diff --git a/.github/workflows/merge-ingest.yml b/.github/workflows/merge-ingest.yml
index 55dcdefbb1..c6be54b490 100644
--- a/.github/workflows/merge-ingest.yml
+++ b/.github/workflows/merge-ingest.yml
@@ -37,7 +37,7 @@ jobs:
                   fetch-depth: 0
                   persist-credentials: false
 
-            - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+            - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
             - name: Resolve reused sweep
               id: reuse
diff --git a/.github/workflows/operatorx-sweep.yml b/.github/workflows/operatorx-sweep.yml
index b258732e93..726ea247b6 100644
--- a/.github/workflows/operatorx-sweep.yml
+++ b/.github/workflows/operatorx-sweep.yml
@@ -56,7 +56,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - name: Plan requested coverage
         id: plan
         env:
diff --git a/.github/workflows/profile.yml b/.github/workflows/profile.yml
index b5f6040a53..88be088396 100644
--- a/.github/workflows/profile.yml
+++ b/.github/workflows/profile.yml
@@ -74,7 +74,7 @@ jobs:
           path: .ci-priority
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - id: gen
         name: Generate matrix via script
         run: |
@@ -284,7 +284,7 @@ jobs:
         with: *tooling-inputs
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/run-sweep.yml b/.github/workflows/run-sweep.yml
index 469a141a1b..2aaa67571d 100644
--- a/.github/workflows/run-sweep.yml
+++ b/.github/workflows/run-sweep.yml
@@ -92,7 +92,7 @@ jobs:
                   fi
 
             - name: Set up uv
-              uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
             - name: Validate perf-changelog matrix
               env:
@@ -218,7 +218,7 @@ jobs:
                         ['infx tooling', data.sha],
                       ]).write();
                       return data.sha;
-            - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+            - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
             - name: Install Claude Code 2.1.282
               id: claude_cli
               if: vars.PRIORITY_SCHEDULER_ENABLED == 'true'
@@ -231,7 +231,7 @@ jobs:
               id: classify
               if: vars.PRIORITY_SCHEDULER_ENABLED == 'true'
               continue-on-error: true
-              uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
+              uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
               with:
                   path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
                   github_token: ${{ github.token }}
@@ -851,7 +851,7 @@ jobs:
                 echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
             - name: Set up uv
-              uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
               with:
                   cache-dependency-glob: |
                       pyproject.toml
@@ -907,7 +907,7 @@ jobs:
                 echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
             - name: Set up uv
-              uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+              uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
               with:
                   cache-dependency-glob: |
                       pyproject.toml
diff --git a/.github/workflows/speedbench-al.yml b/.github/workflows/speedbench-al.yml
index 2396fc41b1..71cb3e706d 100644
--- a/.github/workflows/speedbench-al.yml
+++ b/.github/workflows/speedbench-al.yml
@@ -134,7 +134,7 @@ jobs:
       - name: Require the Python launcher
         if: ${{ inputs.ref && inputs.ref != '' }}
         run: python3 -P -m infx.workflows.require_launcher .measured
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - id: score
         env:
           RUNNER: ${{ inputs.runner }}
@@ -247,7 +247,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           enable-cache: false
 
diff --git a/.github/workflows/stage-results.yml b/.github/workflows/stage-results.yml
index c273fc436b..0031548a7f 100644
--- a/.github/workflows/stage-results.yml
+++ b/.github/workflows/stage-results.yml
@@ -42,7 +42,7 @@ jobs:
           echo "INFERENCEX_PYTHON_PROJECT=$python_project" >> "$GITHUB_ENV"
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-dependency-glob: |
             pyproject.toml
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 2ad99b783d..4a53bdfcd0 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
       - name: Audit GitHub Actions
         env:
           GH_TOKEN: ${{ github.token }}