diff --git a/.github/workflows/cut-release.yml b/.github/workflows/cut-release.yml
index a9f8852..041d655 100644
--- a/.github/workflows/cut-release.yml
+++ b/.github/workflows/cut-release.yml
@@ -62,7 +62,7 @@ jobs:
 
       # `release.sh prepare` refreshes uv.lock when uv is on PATH, so the lock
       # the PR carries matches the bumped version.
-      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
 
       - name: Configure git identity
         env: