diff --git a/.github/workflows/_claude-code.yml b/.github/workflows/_claude-code.yml
index 322a4da1..6f99596d 100644
--- a/.github/workflows/_claude-code.yml
+++ b/.github/workflows/_claude-code.yml
@@ -72,7 +72,7 @@ jobs:
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         shell: bash
         run: |
-          TOML_VERSION=$(uv run python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          TOML_VERSION=$(uv run --frozen python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Run Claude Code (Interactive Mode)
diff --git a/.github/workflows/_package-publish.yml b/.github/workflows/_package-publish.yml
index f2e78ebe..10286254 100644
--- a/.github/workflows/_package-publish.yml
+++ b/.github/workflows/_package-publish.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Validate installation
         shell: bash
         run: |
-          OUTPUT=$(uv run --all-extras --no-dev aignostics --help)
+          OUTPUT=$(uv run --frozen --all-extras --no-dev aignostics --help)
           if [[ "$OUTPUT" != *"built with love in Berlin"* ]]; then
           echo "Output does not contain 'built with love in Berlin'"
           exit 1
@@ -149,7 +149,7 @@ jobs:
       - name: Final smoke test
         shell: bash
         run: |
-          uv run --no-dev aignostics --help
+          uv run --frozen --no-dev aignostics --help
 
       - name: Docs
         shell: bash
diff --git a/.github/workflows/_scheduled-test-daily.yml b/.github/workflows/_scheduled-test-daily.yml
index 572dd408..a676abf8 100644
--- a/.github/workflows/_scheduled-test-daily.yml
+++ b/.github/workflows/_scheduled-test-daily.yml
@@ -76,7 +76,7 @@ jobs:
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         shell: bash
         run: |
-          TOML_VERSION=$(uv run python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          TOML_VERSION=$(uv run --frozen python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Create .env file
@@ -108,7 +108,7 @@ jobs:
         continue-on-error: true
         shell: bash
         run: |
-            OUTPUT=$(uv run --no-dev aignostics --help)
+            OUTPUT=$(uv run --frozen --no-dev aignostics --help)
             if [[ "$OUTPUT" != *"built with love in Berlin"* ]]; then
             echo "Output does not contain 'built with love in Berlin'"
             exit 1
@@ -119,12 +119,12 @@ jobs:
         continue-on-error: true
         shell: bash
         run: |
-          uv run --no-dev aignostics --help
-          uv run --all-extras aignostics system info
-          uv run --all-extras aignostics system health
-          uv run --all-extras aignostics user whoami --mask-secrets
-          uv run --all-extras aignostics application list
-          uv run --all-extras aignostics application run list --verbose --limit 1
+          uv run --frozen --no-dev aignostics --help
+          uv run --frozen --all-extras aignostics system info
+          uv run --frozen --all-extras aignostics system health
+          uv run --frozen --all-extras aignostics user whoami --mask-secrets
+          uv run --frozen --all-extras aignostics application list
+          uv run --frozen --all-extras aignostics application run list --verbose --limit 1
 
       - name: Test / Unit (multiple Python versions)
         id: unit
diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 85c4b021..192e9190 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -100,7 +100,7 @@ jobs:
         shell: bash
         run: |
           TAG_VERSION=${GITHUB_REF#refs/tags/v}
-          TOML_VERSION=$(uv run python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          TOML_VERSION=$(uv run --frozen python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
           if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
             echo "Release version mismatch: Tag $TAG_VERSION != pyproject.toml $TOML_VERSION"
             exit 1
@@ -110,7 +110,7 @@ jobs:
         if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         shell: bash
         run: |
-          TOML_VERSION=$(uv run python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          TOML_VERSION=$(uv run --frozen python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])")
           echo "Development build - Current version in pyproject.toml: $TOML_VERSION"
 
       - name: Create .env file
@@ -140,7 +140,7 @@ jobs:
       - name: Validate installation (single Python version)
         shell: bash
         run: |
-            OUTPUT=$(uv run --no-dev aignostics --help)
+            OUTPUT=$(uv run --frozen --no-dev aignostics --help)
             if [[ "$OUTPUT" != *"built with love in Berlin"* ]]; then
             echo "Output does not contain 'built with love in Berlin'"
             exit 1
@@ -149,12 +149,12 @@ jobs:
       - name: Test / Smoke (single Python version)
         shell: bash
         run: |
-          uv run --no-dev aignostics --help
-          uv run --all-extras aignostics system info
-          uv run --all-extras aignostics system health
-          uv run --all-extras aignostics user whoami --mask-secrets
-          uv run --all-extras aignostics application list
-          uv run --all-extras aignostics application run list --verbose --limit 1
+          uv run --frozen --no-dev aignostics --help
+          uv run --frozen --all-extras aignostics system info
+          uv run --frozen --all-extras aignostics system health
+          uv run --frozen --all-extras aignostics user whoami --mask-secrets
+          uv run --frozen --all-extras aignostics application list
+          uv run --frozen --all-extras aignostics application run list --verbose --limit 1
 
       # All test steps use continue-on-error: true so that every test suite
       # always runs regardless of whether earlier suites failed. This ensures
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 8c91a9c6..d882e271 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -105,9 +105,9 @@ jobs:
           PREV_TAG="${{ steps.version.outputs.prev_tag }}"
           TAG_NAME="${{ steps.version.outputs.tag_name }}"
           if [ -n "$PREV_TAG" ]; then
-            uv run git-cliff --tag "$TAG_NAME" --prepend CHANGELOG.md "${PREV_TAG}..HEAD"
+            uv run --frozen git-cliff --tag "$TAG_NAME" --prepend CHANGELOG.md "${PREV_TAG}..HEAD"
           else
-            uv run git-cliff --tag "$TAG_NAME" --output CHANGELOG.md
+            uv run --frozen git-cliff --tag "$TAG_NAME" --output CHANGELOG.md
           fi
 
       - name: Commit changelog
diff --git a/Dockerfile b/Dockerfile
index ab056b38..64800218 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -30,7 +30,7 @@ FROM builder AS builder-slim
 RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=type=bind,source=uv.lock,target=uv.lock \
     --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
-    uv sync --frozen --no-install-project --no-dev --no-editable
+    uv sync --frozen --no-build --no-install-project --no-dev --no-editable
 
 # Then, add the rest of the project source code and install it
 # Installing separately from its dependencies allows optimal layer caching
@@ -59,7 +59,7 @@ FROM builder AS builder-all
 RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=type=bind,source=uv.lock,target=uv.lock \
     --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
-    uv sync --frozen --no-install-project --all-extras --no-dev --no-editable
+    uv sync --frozen --no-build --no-install-project --all-extras --no-dev --no-editable
 
 # Then, add the rest of the project source code and install it
 # Installing separately from its dependencies allows optimal layer caching