diff --git a/constraints/release-publish.in b/constraints/release-publish.in
index 72959862..2e7704c7 100644
--- a/constraints/release-publish.in
+++ b/constraints/release-publish.in
@@ -1,4 +1,4 @@
 # Direct requirements for the publication jobs; see release-publish.txt for the
 # hash-locked resolution actually installed.
 sigstore==4.5.0
-uv==0.12.5
+uv==0.12.9
diff --git a/constraints/release-publish.txt b/constraints/release-publish.txt
index c55a12d9..c1184a79 100644
--- a/constraints/release-publish.txt
+++ b/constraints/release-publish.txt
@@ -31,7 +31,7 @@ certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
     --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
     # via requests
-cffi==2.1.1 ; platform_python_implementation != 'PyPy' \
+cffi==2.1.1 \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
     --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \
     --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \
@@ -392,11 +392,11 @@ pyasn1==0.6.4 \
     --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
     --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
     # via sigstore
-pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy' \
+pycparser==3.0 \
     --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
     --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
     # via cffi
-pydantic==2.13.5 \
+pydantic[email]==2.13.5 \
     --hash=sha256:346a034f080da3755d8e9cb5e00e8b07de1d39e4f6e2c87d8ab7cafa0b269a73 \
     --hash=sha256:51a9c5f7b2f8e636f04c6cada605d9b6a3bf1348fdf945a3d8869b19bba0ee08
     # via
@@ -604,24 +604,24 @@ urllib3==2.7.0 \
     #   id
     #   requests
     #   tuf
-uv==0.12.5 \
-    --hash=sha256:1a06c8bc4d43b5f6c1e3f2ae3d0f6455b07515f762516f95e52e6c0cbccedf15 \
-    --hash=sha256:2bd62134e56af35b9cf017aaf8ae41a605d6501dd49afc35b70b544a45dd8354 \
-    --hash=sha256:2d65b7b3bc3fd28678f62aa7fb5d90f106ad9782c1354af60b6cecdf9ea9ecd9 \
-    --hash=sha256:39bb102766c95571781a7b4c611675ea213e08df5c680f3936279b3c0d1f6c3c \
-    --hash=sha256:3e195ccf1ed60c8bb24a6447ce306441a4181d54b602407e09bc56e963911c15 \
-    --hash=sha256:442a21d181faae21742aaaf6d2091a0d27755d3eac344061a9a00c90169b7524 \
-    --hash=sha256:455c3e57602e2141e66e2f0bf685898c9c5e5a70377d14c9a71554a3baf3ddbf \
-    --hash=sha256:568485b44e848eb3693f85d6b00299ccd8fc4d26902030dbf24f549c276db9ca \
-    --hash=sha256:58abfb0f658b39a834307a11223bc170294ea214263b4c99ecc7663720d43544 \
-    --hash=sha256:6ad2c455f1fe4d2962f6fd7ccb3b1f61c61856681c9d99f40e170b2074353fa3 \
-    --hash=sha256:712624b62e25c84e5a10fc6aa144d8a81b685fdc067a54a7ca4367d75d2cf791 \
-    --hash=sha256:7817f8e957960f9ddc452ea353f283c0d6393e2e31b400276485adced5b1f371 \
-    --hash=sha256:a05b497c2a948c8600f4c831a89852b4d2514b7f561074225cc9edd0cc4811e2 \
-    --hash=sha256:bd08c82831b0033330f8eeeb0d90f938a4d999f25569bee68a975c736142d795 \
-    --hash=sha256:bea86f27a027e0e3af908db4bdd4f1ceef3ca2bd47673b5ccca7f550e325b1b4 \
-    --hash=sha256:d87156bc174d94fae890bb7a261e2867140abb9fe1e9de81a5295e582fb9d0f5 \
-    --hash=sha256:dc14e4f81a99b585a891350c60d1ff4557d54cb3c3c81fa45fd4e0dd512ba752 \
-    --hash=sha256:edd9ff6154b891146a342c143cd29b330ad97ac6a4b20ff4a99a20a4da84ceca \
-    --hash=sha256:f9656ac7a00fd4314980fb0f790df1c1f3fa9cbcf9af9c6f611b19448b9da687
+uv==0.12.9 \
+    --hash=sha256:00ff9f34c04055ebc3e1599ee459f5ae0d42c17cd6a1d8d029f0389e64a1419c \
+    --hash=sha256:0af988f800778913d36f9bf6905eb21c917dccc403bb364ad739bfd383acf491 \
+    --hash=sha256:0cb7e8a732d81f25d364de8d6ac69f4d00d56b581918ac242eeaeffb53977588 \
+    --hash=sha256:2d4a1d4c067f9e2edf703e181a71db8fc9d7af5fcdbd0053103d0a1260e04ce6 \
+    --hash=sha256:31fddf25d756a51fe33f7831ff697a122628dd3121c37c435c39c678428f937b \
+    --hash=sha256:445c572202243229043abaeab2fecb1b3691477c71c79feb07f638ce34febd39 \
+    --hash=sha256:55b8920edb2a29eeef31e246fb60d2145985e17f51ad14b26643575b82759302 \
+    --hash=sha256:5badfd805fd88bf99b4b4f044f6e8f762f1892cab27477f4427bb473e93dd049 \
+    --hash=sha256:5f9325495fa0bf3e71e6b09f72e68b0d4a000067888b48a659536a8c7191a112 \
+    --hash=sha256:871e884c3329f69c12bb7426edb9e727745c3bb2db6d9e0538ce0e1bdfb64916 \
+    --hash=sha256:97062b2160a97fcfa45f10bbbe02a9c6ba4f5a50cf4e02c0f2babb80b47c1ea8 \
+    --hash=sha256:bbdcb9db8b44d80e3fcebc4205604d52ea145404efb179958560bb2a0157743a \
+    --hash=sha256:c0f7e2b46e4c503f9497c0f41bba3570aa233685db814cd011225118f2d72b6a \
+    --hash=sha256:cafa85338ce1d27b7caa4aadc83ab21f350e2cd2185462fbb10a232b6e93152e \
+    --hash=sha256:cce6e716df290b7f4a31f76ef39866e1dc006e947520a660459dea00b5d55234 \
+    --hash=sha256:ce4ad780d3cefe5a8f965f3ddf942c01e71aa37e36f4fc431e72e4ee8ce5f378 \
+    --hash=sha256:cfb512d0e284e9fc42c3bbe9b701f430083fca23dbb67a20daeea897fb793069 \
+    --hash=sha256:f4ab95475562884fc8e72fbbf0c3da0e025d3bb25e7348544cd02b19bf77f3e1 \
+    --hash=sha256:f639f8415f08918fb4ba2022bfd94d039e01c6c1eca28583125d439f7bd635fb
     # via -r constraints/release-publish.in