diff --git a/.github/workflows/commits-on-main.yml b/.github/workflows/commits-on-main.yml
index a74e7a6..c3d43ec 100644
--- a/.github/workflows/commits-on-main.yml
+++ b/.github/workflows/commits-on-main.yml
@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f2a79ac..f810b92 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh
@@ -51,7 +51,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh
@@ -71,7 +71,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/module-checks.yml b/.github/workflows/module-checks.yml
index e8d1e30..9950d97 100644
--- a/.github/workflows/module-checks.yml
+++ b/.github/workflows/module-checks.yml
@@ -38,7 +38,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh
@@ -82,7 +82,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh
@@ -125,7 +125,7 @@ jobs:
       # The evidence the test sheet links to (docs/os/05-workflow.md §7), kept even on failure.
       - name: Evidence of the scenarios
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: evidence-${{ matrix.module.name }}
           path: ${{ matrix.module.folder }}/.evidence/
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 4605cee..0cd82fa 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
 
       - name: NapkinStack, the project version
         run: bash .nstack/install-engine.sh