diff --git a/constraints/release-publish.in b/constraints/release-publish.in
index 2e7704c7..94f93cc0 100644
--- a/constraints/release-publish.in
+++ b/constraints/release-publish.in
@@ -1,4 +1,4 @@
 # Direct requirements for the publication jobs; see release-publish.txt for the
 # hash-locked resolution actually installed.
 sigstore==4.5.0
-uv==0.12.9
+uv==0.12.23
diff --git a/constraints/release-publish.txt b/constraints/release-publish.txt
index a7155d13..151fecfb 100644
--- a/constraints/release-publish.txt
+++ b/constraints/release-publish.txt
@@ -31,7 +31,7 @@ certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
     --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
     # via requests
-cffi==2.1.1 ; platform_python_implementation != 'PyPy' \
+cffi==2.1.1 \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
     --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \
     --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \
@@ -392,11 +392,11 @@ pyasn1==0.6.4 \
     --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
     --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
     # via sigstore
-pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' \
+pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
     # via cffi
-pydantic==2.13.5 \
+pydantic[email]==2.13.5 \
     --hash=sha256:346a034f080da3755d8e9cb5e00e8b07de1d39e4f6e2c87d8ab7cafa0b269a73 \
     --hash=sha256:51a9c5f7b2f8e636f04c6cada605d9b6a3bf1348fdf945a3d8869b19bba0ee08
     # via
@@ -604,24 +604,24 @@ urllib3==2.7.0 \
     #   id
     #   requests
     #   tuf
-uv==0.12.9 \
-    --hash=sha256:00ff9f34c04055ebc3e1599ee459f5ae0d42c17cd6a1d8d029f0389e64a1419c \
-    --hash=sha256:0af988f800778913d36f9bf6905eb21c917dccc403bb364ad739bfd383acf491 \
-    --hash=sha256:0cb7e8a732d81f25d364de8d6ac69f4d00d56b581918ac242eeaeffb53977588 \
-    --hash=sha256:2d4a1d4c067f9e2edf703e181a71db8fc9d7af5fcdbd0053103d0a1260e04ce6 \
-    --hash=sha256:31fddf25d756a51fe33f7831ff697a122628dd3121c37c435c39c678428f937b \
-    --hash=sha256:445c572202243229043abaeab2fecb1b3691477c71c79feb07f638ce34febd39 \
-    --hash=sha256:55b8920edb2a29eeef31e246fb60d2145985e17f51ad14b26643575b82759302 \
-    --hash=sha256:5badfd805fd88bf99b4b4f044f6e8f762f1892cab27477f4427bb473e93dd049 \
-    --hash=sha256:5f9325495fa0bf3e71e6b09f72e68b0d4a000067888b48a659536a8c7191a112 \
-    --hash=sha256:871e884c3329f69c12bb7426edb9e727745c3bb2db6d9e0538ce0e1bdfb64916 \
-    --hash=sha256:97062b2160a97fcfa45f10bbbe02a9c6ba4f5a50cf4e02c0f2babb80b47c1ea8 \
-    --hash=sha256:bbdcb9db8b44d80e3fcebc4205604d52ea145404efb179958560bb2a0157743a \
-    --hash=sha256:c0f7e2b46e4c503f9497c0f41bba3570aa233685db814cd011225118f2d72b6a \
-    --hash=sha256:cafa85338ce1d27b7caa4aadc83ab21f350e2cd2185462fbb10a232b6e93152e \
-    --hash=sha256:cce6e716df290b7f4a31f76ef39866e1dc006e947520a660459dea00b5d55234 \
-    --hash=sha256:ce4ad780d3cefe5a8f965f3ddf942c01e71aa37e36f4fc431e72e4ee8ce5f378 \
-    --hash=sha256:cfb512d0e284e9fc42c3bbe9b701f430083fca23dbb67a20daeea897fb793069 \
-    --hash=sha256:f4ab95475562884fc8e72fbbf0c3da0e025d3bb25e7348544cd02b19bf77f3e1 \
-    --hash=sha256:f639f8415f08918fb4ba2022bfd94d039e01c6c1eca28583125d439f7bd635fb
+uv==0.12.23 \
+    --hash=sha256:02f2a0fd1cb90b5fc06b52e8cbc3169bdc4e53804e9d66ba0ad516be767424f4 \
+    --hash=sha256:08b2fc8e250efdfc1e47da0483f3e19f433bb0934282361817f61c0b19cb3674 \
+    --hash=sha256:11d18c1589d7907376b4f3fa31028e46cc609ac4b7d83eabc2b04cd8ca1433cc \
+    --hash=sha256:4951286e68f116fa41897ecf8e248cc2836cb013be6d4f37afae4049f9ef4df7 \
+    --hash=sha256:565c6e2874dbeae86c02f3dea97255e878fec672659a73d4930c6b93fcab2fff \
+    --hash=sha256:5b07cbea635177da0d6b902bcde9ce0304c1fa5b49a37b27ef7aa021c5c31697 \
+    --hash=sha256:7a919e3420adf4cc03895b404af655c7229f646bffabbd9a16979683772a7d34 \
+    --hash=sha256:855232fd95d456bd5ee17e262f73112967fbbb2803e745f1911c08ceb042e641 \
+    --hash=sha256:895137194d242cc8075c3006288b485af54feeae68512f4ffc96f75b27543cc0 \
+    --hash=sha256:8f021dfbe5b6081021dd47fd8372cfba386fc5d39161e73d4f33cff90ce1760c \
+    --hash=sha256:9346c741175c7fc0d380f30fcfcb8d5e13f5f900b30536230c8d34208524e47a \
+    --hash=sha256:99197c022afbd1edd0a295e9fdac5078c61eddf2e77657a77294cfe8ea0d94b9 \
+    --hash=sha256:9a65258535db432df51ca7d26338c01431820b94b634762f5718fc55895f974e \
+    --hash=sha256:b03b1c35b5f301e888671eb5d0e74b8789558905db1d411cb8e07ea4ec320268 \
+    --hash=sha256:b70220be9056bd05908770179101a53687eb5c89f72a3edc1e20df0cd3f157c2 \
+    --hash=sha256:c4d236bb220856027ba8e28ef693cac472ee2a740a61faef1ac2001165c7b3d5 \
+    --hash=sha256:e952162a5be6847deaccf3fd5b41a628506fd9ff1ea4363b8c975bd6f927d832 \
+    --hash=sha256:f05c5ad8d6cb4b2659cb6368ed02c067539415b24a2b69effd8ada576fdbf303 \
+    --hash=sha256:fb8a4117a5224d73abe2204a1e744ae34b544f1b9a0b761576851deaa7215c12
     # via -r constraints/release-publish.in