diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2465ced..8c99a86 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,6 +55,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run ruff check
         run: uv run ruff check
@@ -75,6 +78,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run ty
         run: uv run ty check
@@ -92,6 +98,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run tests
         run: uv run pytest --cov
@@ -109,6 +118,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.13.5"
+          python-version: "3.14.9"
 
       - name: Run deptry
         run: uv run --group audit deptry .
diff --git a/flake.nix b/flake.nix
index 356c024..11c3c18 100644
--- a/flake.nix
+++ b/flake.nix
@@ -20,11 +20,11 @@
             deadnix
             ls-lint
             nixfmt
-            python314
             statix
-            uv
           ])
           ++ [
+            (pkgs.callPackage ./nix/python.nix { })
+            (pkgs.callPackage ./nix/uv.nix { })
             # lefthook before 2.1.6 runs hooks under a pty, which agent sandboxes deny.
             nixpkgs-unstable.legacyPackages.${system}.lefthook
           ];
diff --git a/nix/python.nix b/nix/python.nix
new file mode 100644
index 0000000..855215c
--- /dev/null
+++ b/nix/python.nix
@@ -0,0 +1,22 @@
+{
+  fetchurl,
+  mailcap,
+  python314,
+}:
+
+# TODO: Drop this and use pkgs.python314 once the nixpkgs input has >= 3.14.9.
+# 3.14.9 replaces the compromised emSign root in the bundled pip/certifi CA store.
+# nixpkgs' mimetypes patch no longer applies to 3.14.9's `knownfiles`, so the same
+# substitution is done in postPatch instead.
+(python314.override { mimetypesSupport = false; }).overrideAttrs (previousAttrs: rec {
+  version = "3.14.9";
+  src = fetchurl {
+    url = "https://www.python.org/ftp/python/${version}/Python-${version}.tar.xz";
+    hash = "sha256-4C2awhzr2m5GQ1NpdEqSxlzHzYZpaXaUEiz5f/rNHlM=";
+  };
+
+  postPatch = (previousAttrs.postPatch or "") + ''
+    substituteInPlace Lib/mimetypes.py \
+      --replace-fail '"/etc/mime.types",' '"${mailcap}/etc/mime.types",'
+  '';
+})
diff --git a/nix/uv.nix b/nix/uv.nix
new file mode 100644
index 0000000..006cd96
--- /dev/null
+++ b/nix/uv.nix
@@ -0,0 +1,43 @@
+{
+  fetchurl,
+  lib,
+  stdenvNoCC,
+  versionCheckHook,
+}:
+
+# TODO: Drop this and use pkgs.uv once the nixpkgs input has >= 0.13.5.
+# Official build of uv 0.13.5. 0.13.4 drops the compromised emSign root from its bundled CA store,
+# but 0.13.5 is the first release that can install managed CPython 3.14.9.
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "uv";
+  version = "0.13.5";
+
+  src = fetchurl {
+    url = "https://github.com/astral-sh/uv/releases/download/${finalAttrs.version}/uv-aarch64-apple-darwin.tar.gz";
+    hash = "sha256-dD+FA1oZluyzUGWeAc2frqlwmCm+CbG0sDxz6vPJzXM=";
+  };
+
+  dontBuild = true;
+  dontStrip = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t "$out/bin" uv uvx
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Python package and project manager, official macOS build";
+    homepage = "https://github.com/astral-sh/uv";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    mainProgram = "uv";
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})
diff --git a/pyproject.toml b/pyproject.toml
index 337eac1..2d116af 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,7 +3,7 @@ name = "template-python"
 version = "0.1.0"
 description = ""
 readme = "README.md"
-requires-python = "== 3.14.*"
+requires-python = ">= 3.14.9, < 3.15"
 dependencies = []
 
 [tool.hatch.build.targets.wheel]
diff --git a/uv.lock b/uv.lock
index b1f817c..a81a514 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,9 +1,9 @@
 version = 1
-revision = 3
-requires-python = "==3.14.*"
+revision = 5
+requires-python = ">=3.14.9, <3.15"
 
 [options]
-exclude-newer = "2026-04-19T10:11:07.025841Z"
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
 exclude-newer-span = "P1W"
 
 [[package]]
@@ -208,6 +208,7 @@ wheels = [
 name = "template-python"
 version = "0.1.0"
 source = { virtual = "." }
+default-groups = ["lint", "test", "typecheck"]
 
 [package.dev-dependencies]
 audit = [