diff --git a/constraints/release-publish.in b/constraints/release-publish.in
index 2e7704c7..a4befbd0 100644
--- a/constraints/release-publish.in
+++ b/constraints/release-publish.in
@@ -1,4 +1,4 @@
 # Direct requirements for the publication jobs; see release-publish.txt for the
 # hash-locked resolution actually installed.
 sigstore==4.5.0
-uv==0.12.9
+uv==0.13.1
diff --git a/constraints/release-publish.txt b/constraints/release-publish.txt
index a7155d13..7b7726ad 100644
--- a/constraints/release-publish.txt
+++ b/constraints/release-publish.txt
@@ -31,7 +31,7 @@ certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
     --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
     # via requests
-cffi==2.1.1 ; platform_python_implementation != 'PyPy' \
+cffi==2.1.1 \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
     --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \
     --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \
@@ -392,11 +392,11 @@ pyasn1==0.6.4 \
     --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
     --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
     # via sigstore
-pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' \
+pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
     # via cffi
-pydantic==2.13.5 \
+pydantic[email]==2.13.5 \
     --hash=sha256:346a034f080da3755d8e9cb5e00e8b07de1d39e4f6e2c87d8ab7cafa0b269a73 \
     --hash=sha256:51a9c5f7b2f8e636f04c6cada605d9b6a3bf1348fdf945a3d8869b19bba0ee08
     # via
@@ -604,24 +604,24 @@ urllib3==2.7.0 \
     #   id
     #   requests
     #   tuf
-uv==0.12.9 \
-    --hash=sha256:00ff9f34c04055ebc3e1599ee459f5ae0d42c17cd6a1d8d029f0389e64a1419c \
-    --hash=sha256:0af988f800778913d36f9bf6905eb21c917dccc403bb364ad739bfd383acf491 \
-    --hash=sha256:0cb7e8a732d81f25d364de8d6ac69f4d00d56b581918ac242eeaeffb53977588 \
-    --hash=sha256:2d4a1d4c067f9e2edf703e181a71db8fc9d7af5fcdbd0053103d0a1260e04ce6 \
-    --hash=sha256:31fddf25d756a51fe33f7831ff697a122628dd3121c37c435c39c678428f937b \
-    --hash=sha256:445c572202243229043abaeab2fecb1b3691477c71c79feb07f638ce34febd39 \
-    --hash=sha256:55b8920edb2a29eeef31e246fb60d2145985e17f51ad14b26643575b82759302 \
-    --hash=sha256:5badfd805fd88bf99b4b4f044f6e8f762f1892cab27477f4427bb473e93dd049 \
-    --hash=sha256:5f9325495fa0bf3e71e6b09f72e68b0d4a000067888b48a659536a8c7191a112 \
-    --hash=sha256:871e884c3329f69c12bb7426edb9e727745c3bb2db6d9e0538ce0e1bdfb64916 \
-    --hash=sha256:97062b2160a97fcfa45f10bbbe02a9c6ba4f5a50cf4e02c0f2babb80b47c1ea8 \
-    --hash=sha256:bbdcb9db8b44d80e3fcebc4205604d52ea145404efb179958560bb2a0157743a \
-    --hash=sha256:c0f7e2b46e4c503f9497c0f41bba3570aa233685db814cd011225118f2d72b6a \
-    --hash=sha256:cafa85338ce1d27b7caa4aadc83ab21f350e2cd2185462fbb10a232b6e93152e \
-    --hash=sha256:cce6e716df290b7f4a31f76ef39866e1dc006e947520a660459dea00b5d55234 \
-    --hash=sha256:ce4ad780d3cefe5a8f965f3ddf942c01e71aa37e36f4fc431e72e4ee8ce5f378 \
-    --hash=sha256:cfb512d0e284e9fc42c3bbe9b701f430083fca23dbb67a20daeea897fb793069 \
-    --hash=sha256:f4ab95475562884fc8e72fbbf0c3da0e025d3bb25e7348544cd02b19bf77f3e1 \
-    --hash=sha256:f639f8415f08918fb4ba2022bfd94d039e01c6c1eca28583125d439f7bd635fb
+uv==0.13.1 \
+    --hash=sha256:0f9991b8eedca00b6aeb9a8fc6b225f6afa2e24ec9de6b6ef72845f3a545639c \
+    --hash=sha256:1f6ae6f843ee01a1bb69e2e7a881a452890eb9acc686a8c37e8e95093a58f68e \
+    --hash=sha256:23dfbdcfd9ff0dc7fefb1b91a6dbca2d492267976becd7c46501f89fc353fdc7 \
+    --hash=sha256:29b9d0dbe9c44d3dcea8af9e7b4ea2444c7a0c9ec0a11e2f2d357fb3afa2c05b \
+    --hash=sha256:4af921c96f5f85c456c7fa93a9bc13514a2a5bbab11ce63dbf490d6e5bfef503 \
+    --hash=sha256:4f693cd4feb52f08f30474c4612f24be2050472609be65b9960b635f286da284 \
+    --hash=sha256:696dcf6d807d85da978f4db8472da81dccc1254b18b52cbd1367c4d923c421e0 \
+    --hash=sha256:6df50a86b09be66a413f8f1b16258d585d4dd1cbff591077ae1e6f65c26de2eb \
+    --hash=sha256:6f1f391756385e2cd1521fe4a198e0ca764ef498dd677cb214b95a69a7ce3608 \
+    --hash=sha256:7161cfb854f7353fd351e5e735e3659ed48412352b1edd4d93212c82ec0cbdf0 \
+    --hash=sha256:7e60223e3e9636a3734d6c11b3552aeed987c40f1ca2497a546af58f2f883d56 \
+    --hash=sha256:81345a4733737a378db988aea48fd5d1c76c092cf231e6ddfdb6db225b4b21e5 \
+    --hash=sha256:b173413a5dc18437b2d28266a02be636f35ac7e97741773aed163ed2143abfaf \
+    --hash=sha256:b5e1b930cbb463c0d8f6b925743ddbae31277841f16c324d14e1a815b0c3b824 \
+    --hash=sha256:ccbe233d4bce39865af7c30ec1fb28b0cc353f9d51711629f54fca71b8db7382 \
+    --hash=sha256:cfa719fbbd23f26713394dea2692b7f146aa1b5713ce5e776e878701214ea52c \
+    --hash=sha256:d6aaec25ff6900ee30a29a2e7a3335aff19a2305c60488bb4e0f29cf1d6ada9f \
+    --hash=sha256:ec1bdc90e2cccc32f51dcea2fa4ec9082b321c77f3fe51a0407d40e8a44f540f \
+    --hash=sha256:f2518450da2f6d0ea8a943c9f402abda63d5a66acc9999216c2792115b922ba4
     # via -r constraints/release-publish.in