diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 82cf0e3..cc72107 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,9 @@ name: Tests
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: 1
 
@@ -16,25 +19,26 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
-          cache: pip
+
+      - name: Install uv
+        uses: hynek/setup-cached-uv@v2
+        with:
           cache-dependency-path: |
             .github/workflows/ci.yml
             dev-requirements.txt
             requirements.txt
 
-      - name: Install dependencies
-        run: |
-          python3 -m pip install -U coverage tox
-
-      - name: Tests
+      - name: Tox tests
         run: |
-          tox -e py
+          uvx --with tox-uv tox -e py
 
       - name: Upload coverage
         uses: codecov/codecov-action@v4
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0dc0bab..e535eb6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-      - uses: pre-commit/action@v3.0.1
+      - uses: tox-dev/action-pre-commit-uv@v1
diff --git a/tox.ini b/tox.ini
index 0351f4a..98435da 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,9 +5,9 @@ env_list =
     py{312, 311, 310, 39}
 
 [testenv]
+deps =
+    -r dev-requirements.txt
 pass_env =
     FORCE_COLOR
-commands_pre =
-    {envpython} -m pip install -U -r dev-requirements.txt
 commands =
     {envpython} -m pytest {posargs}