diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0def82604..24ae21158 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -485,6 +485,10 @@ jobs:
       - name: Install python
         run: uv python install 3.11
 
+      - name: Verify uv.lock matches pyproject.toml
+        working-directory: ./python
+        run: uv lock --check
+
       - name: Sync dependencies
         working-directory: ./python
         run: uv sync --all-extras
diff --git a/python/Dockerfile b/python/Dockerfile
index d332e4432..4b9477437 100644
--- a/python/Dockerfile
+++ b/python/Dockerfile
@@ -1,5 +1,5 @@
 ### STAGE 1: uv binary
-ARG UV_VERSION=0.11.15
+ARG UV_VERSION=0.12.3
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 
 ### STAGE 2: builder
@@ -53,8 +53,19 @@ ARG VERSION
 RUN --mount=type=cache,target=/.kagent/cache,rw                               \
     echo "Creating virtual environment and installing dependencies..."        \
     && uv venv --python=python$TOOLS_PYTHON_VERSION                           \
-    && uv lock && uv sync --package kagent-adk --no-editable                  \
+    && uv sync --frozen --package kagent-adk --no-editable                    \
     && uv cache prune                                                         \
+    # The standalone CPython build bundles pip (with vendored msgpack /
+    # pkg_resources) in its own site-packages. The runtime only uses the venv,
+    # so drop it rather than shipping CVE-flagged packages that nothing imports.
+    && rm -rf /python/cpython-*/lib/python*/site-packages/pip                 \
+              /python/cpython-*/lib/python*/site-packages/pip-*.dist-info     \
+              /python/cpython-*/lib/python*/site-packages/setuptools          \
+              /python/cpython-*/lib/python*/site-packages/setuptools-*.dist-info \
+              /python/cpython-*/lib/python*/site-packages/pkg_resources      \
+    # Fail the build if pip survived (rm -rf on a non-matching glob exits 0,
+    # e.g. after a Python minor bump moves site-packages).
+    && ! "$(uv python find)" -c "import pip" 2>/dev/null                      \
     && echo "Installation complete."
 
 # Pre-create the config dir owned by the runtime user. On Agent Substrate the config is
diff --git a/python/Dockerfile.full b/python/Dockerfile.full
index da24c0be3..9d567da02 100644
--- a/python/Dockerfile.full
+++ b/python/Dockerfile.full
@@ -6,7 +6,7 @@
 # and for sandboxed BYO agents.
 
 ### STAGE 1: uv binary
-ARG UV_VERSION=0.11.15
+ARG UV_VERSION=0.12.3
 FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv-bin
 
 ### STAGE 2: base os + sandbox runtime
@@ -98,7 +98,7 @@ ARG VERSION
 RUN --mount=type=cache,target=/.kagent/cache,uid=1001,gid=1001                \
     echo "Creating virtual environment and installing dependencies..."        \
     && uv venv --python=python$TOOLS_PYTHON_VERSION                           \
-    && uv lock && uv sync --package kagent-adk                                \
+    && uv sync --frozen --package kagent-adk                                  \
     && uv cache prune                                                         \
     && echo "Installation complete."
 
diff --git a/python/pyproject.toml b/python/pyproject.toml
index 7151f3a55..d0e2d17d8 100644
--- a/python/pyproject.toml
+++ b/python/pyproject.toml
@@ -14,6 +14,7 @@ constraint-dependencies = [
     "aiohttp>=3.14.3",
     "cryptography>=50.0.0",
     "httplib2>=0.32.0",
+    "idna>=3.15",
     "jaraco-context>=6.1.0",
     "joserfc>=1.6.8",
     "mako>=1.3.12",
diff --git a/python/uv.lock b/python/uv.lock
index c22eb25e4..3b60d5103 100644
--- a/python/uv.lock
+++ b/python/uv.lock
@@ -29,6 +29,7 @@ constraints = [
     { name = "aiohttp", specifier = ">=3.14.3" },
     { name = "cryptography", specifier = ">=50.0.0" },
     { name = "httplib2", specifier = ">=0.32.0" },
+    { name = "idna", specifier = ">=3.15" },
     { name = "jaraco-context", specifier = ">=6.1.0" },
     { name = "joserfc", specifier = ">=1.6.8" },
     { name = "mako", specifier = ">=1.3.12" },
@@ -1572,11 +1573,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.10"
+version = "3.18"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
 ]
 
 [[package]]