diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c33e62d5..654f0661 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,12 +2,15 @@ name: Tests
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: 1
 
 jobs:
   test:
-    name: test w/ Python ${{ matrix.python-version }}
+    name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -17,23 +20,26 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
-          cache: pip
+
+      - name: Install uv
+        uses: hynek/setup-cached-uv@v2
+        with:
           cache-dependency-path: |
             requirements.txt
             dev-requirements.txt
-      - name: Install tox
+
+      - name: Tox tests
         run: |
-          python -m pip install tox
-      - name: Run Tests
-        env:
-          # run against the current Python interpreter
-          TOXENV: py
-        run: tox
+          uvx --with tox-uv tox -e py
+
       - uses: codecov/codecov-action@v4
         if: always()
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0dc0bab9..e535eb6f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-      - uses: pre-commit/action@v3.0.1
+      - uses: tox-dev/action-pre-commit-uv@v1