diff --git a/.github/workflows/builddoc.yml b/.github/workflows/builddoc.yml
index e709d3dbb26..ac4abbf7982 100644
--- a/.github/workflows/builddoc.yml
+++ b/.github/workflows/builddoc.yml
@@ -14,7 +14,6 @@ concurrency:
 
 env:
   FORCE_COLOR: "1"
-  UV_SYSTEM_PYTHON: "1"  # make uv do global installs
 
 jobs:
   verbose:
@@ -30,18 +29,6 @@ jobs:
         python-version: "3"
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group docs
+    - uses: astral-sh/setup-uv@v7
     - name: Render the documentation
-      run: >
-        sphinx-build
-        -M html ./doc ./build/sphinx
-        --verbose
-        --jobs=auto
-        --show-traceback
-        --fail-on-warning
+      run: uv run --locked --group docs sphinx-build -M html ./doc ./build/sphinx --verbose --jobs=auto --show-traceback --fail-on-warning
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 5a820e5aa4d..95b2351506c 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -15,7 +15,6 @@ concurrency:
 
 env:
   FORCE_COLOR: "1"
-  UV_SYSTEM_PYTHON: "1"  # make uv do global installs
 
 jobs:
   publish-pypi:
@@ -34,20 +33,13 @@ jobs:
         uses: actions/setup-python@v6
         with:
           python-version: "3"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: latest
-          enable-cache: false
-
-      - name: Install build dependencies (pypa/build, twine)
-        run: uv pip install --group package
+      - uses: astral-sh/setup-uv@v7
 
       - name: Build distribution
-        run: python -m build
+        run: uv run --locked --no-default-groups --group package python -m build .
 
       - name: Check distribution
-        run: twine check dist/*
+        run: uv run --locked --no-default-groups --group package twine check dist/*.{whl,tar.gz}
 
       - name: Create Sigstore attestations for built distributions
         uses: actions/attest@v1
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 04c3ec45b79..3f3cfd754b4 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,7 +14,6 @@ concurrency:
 
 env:
   FORCE_COLOR: "1"
-  UV_SYSTEM_PYTHON: "1"  # make uv do global installs
 
 jobs:
   # If you update any of these commands, don't forget to update the equivalent
@@ -49,15 +48,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: "3"
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install -r pyproject.toml --group package --group test --group types
+    - uses: astral-sh/setup-uv@v7
     - name: Type check with mypy
-      run: mypy
+      run: uv run --locked --group package --group test --group types mypy
 
   pyright:
     runs-on: ubuntu-latest
@@ -70,15 +63,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: "3"
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install -r pyproject.toml --group package --group test --group types
+    - uses: astral-sh/setup-uv@v7
     - name: Type check with pyright
-      run: pyright
+      run: uv run --locked --group package --group test --group types pyright
 
   ty:
     runs-on: ubuntu-latest
@@ -91,15 +78,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: "3"
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install -r pyproject.toml --group package --group test --group types
+    - uses: astral-sh/setup-uv@v7
     - name: Type check with ty
-      run: ty check --color=always
+      run: uv run --locked --group package --group test --group types ty check --color=always
 
   docs-lint:
     runs-on: ubuntu-latest
@@ -112,15 +93,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: "3"
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install --group lint
+    - uses: astral-sh/setup-uv@v7
     - name: Lint documentation with sphinx-lint
-      run: make doclinter
+      run: uv run --locked --group lint make doclinter
 
   twine:
     runs-on: ubuntu-latest
@@ -133,17 +108,9 @@ jobs:
       uses: actions/setup-python@v6
       with:
         python-version: "3"
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install --group package
+    - uses: astral-sh/setup-uv@v7
     - name: Lint with twine
-      run: |
-        python -m build .
-        twine check dist/*
+      run: uv run --locked --no-default-groups --group package python -m build . && uv run --locked --no-default-groups --group package twine check dist/*.{whl,tar.gz}
 
   prettier:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e30925f215b..85470f8b95c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -23,9 +23,6 @@ concurrency:
 
 env:
   FORCE_COLOR: "1"
-  PYTHONDEVMODE: "1"  # -X dev
-  PYTHONWARNDEFAULTENCODING: "1"  # -X warn_default_encoding
-  UV_SYSTEM_PYTHON: "1"  # make uv do global installs
 
 jobs:
   ubuntu:
@@ -42,6 +39,7 @@ jobs:
         - "3.13t"
         - "3.14"
         - "3.14t"
+        - "3.15"
         docutils:
         - "0.20"
         - "0.22"
@@ -58,99 +56,13 @@ jobs:
       run: |
         mkdir -p ./tests/roots-read-only
         sudo mount -v --bind --read-only ./tests/roots ./tests/roots-read-only
-    - name: Set up Python ${{ matrix.python }}
-      uses: actions/setup-python@v6
-      with:
-        python-version: ${{ matrix.python }}
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test
-      env:
-        UV_PYTHON: "python${{ matrix.python }}"
-    - name: Install Docutils ${{ matrix.docutils }}
-      run: uv pip install --upgrade "docutils~=${{ matrix.docutils }}.0"
-      env:
-        UV_PYTHON: "python${{ matrix.python }}"
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -n logical --dist=worksteal -vv --durations 25
+      run: uv run --locked --python ${{ matrix.python }} --no-default-groups --group test --with "docutils~=${{ matrix.docutils }}.0" pytest -n logical --dist=worksteal -vv --durations 25
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
-
-  deadsnakes:
-    runs-on: ubuntu-latest
-    name: Python ${{ matrix.python }} (Docutils ${{ matrix.docutils }})
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        python:
-        - "3.15"
-        docutils:
-        - "0.20"
-        - "0.22"
-
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: Set up Python ${{ matrix.python }} (deadsnakes)
-      uses: deadsnakes/action@v3.2.0
-      with:
-        python-version: ${{ matrix.python }}-dev
-    - name: Check Python version
-      run: python --version --version
-    - name: Install graphviz
-      run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install . --group test
-    - name: Install Docutils ${{ matrix.docutils }}
-      run: python -m pip install --upgrade "docutils~=${{ matrix.docutils }}.0"
-    - name: Test with pytest
-      run: python -m pytest -n logical --dist=worksteal -vv --durations 25
-      env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
-
-  deadsnakes-free-threaded:
-    runs-on: ubuntu-latest
-    name: Python ${{ matrix.python }} (free-threaded)
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        python:
-        - "3.15"
-
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        persist-credentials: false
-    - name: Set up Python ${{ matrix.python }} (deadsnakes)
-      uses: deadsnakes/action@v3.2.0
-      with:
-        python-version: ${{ matrix.python }}-dev
-        nogil: true
-    - name: Check Python version
-      run: python --version --version
-    - name: Install graphviz
-      run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install . --group test
-    - name: Test with pytest
-      run: python -m pytest -n logical --dist=worksteal -vv --durations 25
-      env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
 
   windows:
     runs-on: windows-latest
@@ -169,25 +81,13 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: choco install --no-progress graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -vv --durations 25
+      run: uv run --locked --no-default-groups --group test pytest -vv --durations 25
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
 
   macos:
     runs-on: macos-latest
@@ -198,25 +98,13 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: brew install graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -vv --durations 25
+      run: uv run --locked --no-default-groups --group test pytest -vv --durations 25
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
 
   docutils-latest:
     runs-on: ubuntu-latest
@@ -233,27 +121,13 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test
-    - name: Install Docutils' HEAD
-      run: uv pip install "docutils @ git+https://repo.or.cz/docutils.git#subdirectory=docutils"
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -n logical --dist=worksteal -vv
+      run: uv run --locked --no-default-groups --group test --with "docutils @ git+https://repo.or.cz/docutils.git#subdirectory=docutils" pytest -n logical --dist=worksteal -vv
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
         DO_EPUBCHECK: "1"
         EPUBCHECK_PATH: "/tmp/epubcheck/epubcheck-5.1.0/epubcheck.jar"
 
@@ -266,27 +140,13 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: |
-        uv pip install . --group test --resolution lowest-direct
-        uv pip install alabaster==1.0.0
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -n logical --dist=worksteal -vv --durations 25
+      run: uv run --locked --no-default-groups --group test --with alabaster==1.0.0 pytest -n logical --dist=worksteal -vv --durations 25
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
 
   latex:
     runs-on: ubuntu-latest
@@ -299,25 +159,11 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test
-    - name: Install Docutils' HEAD
-      run: uv pip install "docutils @ git+https://repo.or.cz/docutils.git#subdirectory=docutils"
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -vv --durations 25
+      run: uv run --locked --no-default-groups --group test --with "docutils @ git+https://repo.or.cz/docutils.git#subdirectory=docutils" pytest -vv --durations 25
       env:
-        PYTHONWARNINGS: "error"  # treat all warnings as errors
+        PYTHONWARNINGS: "error"
         DO_EPUBCHECK: "1"
 
   coverage:
@@ -330,24 +176,10 @@ jobs:
     - uses: actions/checkout@v6
       with:
         persist-credentials: false
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: "3"
-    - name: Check Python version
-      run: python --version --version
     - name: Install graphviz
       run: sudo apt-get install --no-install-recommends --yes graphviz
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        version: latest
-        enable-cache: false
-    - name: Install dependencies
-      run: uv pip install . --group test pytest-cov
+    - uses: astral-sh/setup-uv@v7
     - name: Test with pytest
-      run: python -m pytest -vv --cov . --cov-append --cov-config pyproject.toml
-      env:
-        VIRTUALENV_SYSTEM_SITE_PACKAGES: "1"
+      run: uv run --locked --no-default-groups --group test --with pytest-cov pytest -vv --cov . --cov-append --cov-config pyproject.toml
     - name: codecov
       uses: codecov/codecov-action@v5