diff --git a/.github/uv.toml b/.github/uv.toml
new file mode 100644
index 000000000..088d7e65f
--- /dev/null
+++ b/.github/uv.toml
@@ -0,0 +1,5 @@
+# Single source of truth for the uv version: CI reads it via setup-uv's
+# version-file input; Justfile lock recipes read it via the uv-pin variable.
+# Kept inside .github/ so uv's config discovery never finds it -- a uv.toml at
+# the repo root would enforce required-version on every local uv command.
+required-version = "==0.11.14"
diff --git a/.github/workflows/dependency-integrity-check.yml b/.github/workflows/dependency-integrity-check.yml
index 298b378ff..50a3417cb 100644
--- a/.github/workflows/dependency-integrity-check.yml
+++ b/.github/workflows/dependency-integrity-check.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master' || github.ref_name == 'development' || github.ref_name == 'dev') }}
 
diff --git a/.github/workflows/pr-core-gate.yml b/.github/workflows/pr-core-gate.yml
index b71b364e8..bb1c2f859 100644
--- a/.github/workflows/pr-core-gate.yml
+++ b/.github/workflows/pr-core-gate.yml
@@ -95,7 +95,7 @@ jobs:
         if: steps.detect.outputs.run == 'true'
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
@@ -198,7 +198,7 @@ jobs:
         if: steps.detect.outputs.run == 'true'
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
diff --git a/.github/workflows/python-release.yml b/.github/workflows/python-release.yml
index 5fc2f298e..1f98079b9 100644
--- a/.github/workflows/python-release.yml
+++ b/.github/workflows/python-release.yml
@@ -136,7 +136,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
@@ -221,7 +221,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
 
       - name: Download PR smoke artifacts
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
diff --git a/.github/workflows/python-test.yml b/.github/workflows/python-test.yml
index e5873b2c3..4a66aa507 100644
--- a/.github/workflows/python-test.yml
+++ b/.github/workflows/python-test.yml
@@ -83,7 +83,7 @@ jobs:
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
-        version: "0.11.14"
+        version-file: ".github/uv.toml"
         enable-cache: true
         save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
@@ -170,7 +170,7 @@ jobs:
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
-        version: "0.11.14"
+        version-file: ".github/uv.toml"
         enable-cache: true
         save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
@@ -289,7 +289,7 @@ jobs:
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
-        version: "0.11.14"
+        version-file: ".github/uv.toml"
         enable-cache: true
         save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
@@ -430,7 +430,7 @@ jobs:
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
-        version: "0.11.14"
+        version-file: ".github/uv.toml"
 
     - name: Set up Rust (Windows)
       if: runner.os == 'Windows' && matrix.include-llvm
@@ -564,7 +564,7 @@ jobs:
     - name: Install the latest version of uv
       uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       with:
-        version: "0.11.14"
+        version-file: ".github/uv.toml"
         enable-cache: true
         save-cache: ${{ github.event_name == 'push' && contains(fromJSON('["main", "master", "development", "dev"]'), github.ref_name) }}
 
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
index 056214914..cae649a75 100644
--- a/.github/workflows/rust-test.yml
+++ b/.github/workflows/rust-test.yml
@@ -176,7 +176,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
       - name: Install integrity check tools
         run: |
           sudo apt-get update
diff --git a/.github/workflows/selene-plugins.yml b/.github/workflows/selene-plugins.yml
index d39ae88d5..a0428a09b 100644
--- a/.github/workflows/selene-plugins.yml
+++ b/.github/workflows/selene-plugins.yml
@@ -63,7 +63,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master' || github.ref_name == 'development' || github.ref_name == 'dev') }}
 
@@ -166,7 +166,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master' || github.ref_name == 'development' || github.ref_name == 'dev') }}
 
diff --git a/.github/workflows/test-docs-examples.yml b/.github/workflows/test-docs-examples.yml
index 70fa998be..429c917b4 100644
--- a/.github/workflows/test-docs-examples.yml
+++ b/.github/workflows/test-docs-examples.yml
@@ -58,7 +58,7 @@ jobs:
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
-          version: "0.11.14"
+          version-file: ".github/uv.toml"
           enable-cache: true
           save-cache: ${{ github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'master' || github.ref_name == 'development' || github.ref_name == 'dev') }}
 
diff --git a/Justfile b/Justfile
index 6ad900494..9d38a0c46 100644
--- a/Justfile
+++ b/Justfile
@@ -33,6 +33,12 @@ set shell := ["bash", "-cu"]
 # PECOS CLI - must be installed (run 'just install-cli' first)
 pecos := "cargo run --locked -p pecos-cli --"
 
+# uv version for lockfile generation, single-sourced from the CI pin.
+# Lockfiles must be written by this exact version: a different uv can
+# re-simplify dependency markers, polluting diffs and failing CI's
+# `uv lock --check`.
+uv-pin := `sed -n 's/^required-version = "==\(.*\)"$/\1/p' .github/uv.toml`
+
 # =============================================================================
 # Getting Started
 # =============================================================================
@@ -1134,11 +1140,19 @@ build-release: (build "release")
 [private]
 build-native: (build "native")
 
+# Re-resolve uv lockfiles minimally (no dependency updates), e.g. after a version bump
+[group('setup')]
+lock:
+    uvx uv@{{uv-pin}} lock --project .
+    uvx uv@{{uv-pin}} lock --project exp/zluppy
+
 # Regenerate all lockfiles from scratch
 [group('setup')]
 updatelocks: _msvc-bootstrap
-    rm -f uv.lock Cargo.lock
-    uv lock --project .
+    rm -f uv.lock Cargo.lock exp/zlup/uv.lock exp/zluppy/uv.lock
+    uvx uv@{{uv-pin}} lock --project .
+    uvx uv@{{uv-pin}} lock --project exp/zlup
+    uvx uv@{{uv-pin}} lock --project exp/zluppy
     cargo generate-lockfile
 
 # Install CUDA Python packages (requires CUDA toolkit)
diff --git a/RELEASING.md b/RELEASING.md
index 724f04ef7..c79554770 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -2,7 +2,7 @@
 
 The final PyPI push is deliberately **manual**: artifact building and testing
 are automated, but a human runs the upload and confirms each package. This
-sequence was last exercised for `0.9.0.dev0`.
+sequence was last exercised for `0.9.0.dev1`.
 
 ## 1. Version bump (its own PR)
 
@@ -13,9 +13,9 @@ The version is a literal in many coordinated places. Bump them all:
   `python/selene-plugins/*` packages)
 - Exact-version internal pins: the root's `quantum-pecos[cuda12/13]==...`
   entries and quantum-pecos's `pecos-rslib==...` / `pecos-rslib-llvm==...`
-- Regenerate both lockfiles: `uv lock` at the root and in `exp/zluppy/`,
-  using the same uv version CI pins in `.github/workflows/` (verify the
-  diffs are version-lines-only)
+- Regenerate both lockfiles: `just lock` (runs the pinned uv from
+  `.github/uv.toml` at the root and in `exp/zluppy/`; verify the diffs
+  are version-lines-only)
 
 Verify: `git grep <old-version>` returns nothing outside this file's
 historical note; `uv lock --check` passes;