diff --git a/.github/workflows/build-docker-images.yml b/.github/workflows/build-docker-images.yml
index 14b41c289..6286c0ff3 100644
--- a/.github/workflows/build-docker-images.yml
+++ b/.github/workflows/build-docker-images.yml
@@ -267,7 +267,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           version: "0.11.29"
           enable-cache: false
diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
index acb667d0e..9ab6b2a70 100644
--- a/.github/workflows/dependency-audit.yml
+++ b/.github/workflows/dependency-audit.yml
@@ -59,7 +59,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Pin jak w tests.yml (job `lock-check`): bez tego setup-uv bierze
           # "latest", a `uv export` zaczyna zalezec od daty przebiegu.
@@ -127,7 +127,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Pin jak wyzej — SBOM ma byc funkcja tresci repo, nie daty runu.
           version: "0.11.29"
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 3347698e2..4151dfd10 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -47,7 +47,7 @@ jobs:
           git fetch --tags origin master dev '+refs/heads/release/*:refs/remotes/origin/release/*'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Pin jak w tests.yml (job `lock-check`) — sciezka wydawnicza tym
           # bardziej nie moze zalezec od plywajacej wersji narzedzia.
diff --git a/.github/workflows/refresh-baseline.yml b/.github/workflows/refresh-baseline.yml
index 285367061..1b4199c2d 100644
--- a/.github/workflows/refresh-baseline.yml
+++ b/.github/workflows/refresh-baseline.yml
@@ -41,7 +41,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Pin jak w tests.yml (job `lock-check`). Tu szczegolnie wazny:
           # baseline commitowany do repo nie moze zalezec od tego, ktora
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
index 78be3a017..e22f07ea2 100644
--- a/.github/workflows/release-candidate.yml
+++ b/.github/workflows/release-candidate.yml
@@ -94,7 +94,7 @@ jobs:
           git fetch --tags origin dev
 
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Bez cache: w tym jobie uv służy wyłącznie do `uvx bumpver`
           # (drobne narzędzie w izolowanym env) — cache uv-a dawał tu
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b3f878976..ae7bb03ca 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -56,7 +56,7 @@ jobs:
       # so the heavy toolchain the test jobs need is unnecessary for
       # linting. uv is only a fast launcher for pre-commit (via uvx).
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # Patrz komentarz przy jobie `lock-check` — bez `version` setup-uv
           # bierze "latest", co czyni CI niedeterministycznym.
@@ -148,7 +148,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
         with:
           # PIN OBOWIAZKOWY. Bez `version` setup-uv loguje "Could not
           # determine uv version from uv.toml or pyproject.toml. Falling back
@@ -190,7 +190,7 @@ jobs:
         xargs -a docker/bpp_base/build.txt sudo apt-get install -y
 
     - name: Install uv
-      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
       with:
         # Patrz komentarz przy jobie `lock-check`. Tu dochodzi drugi powod:
         # `uv sync --frozen` czyta uv.lock, wiec plywajaca wersja uv czyni