diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 760dc22..16aee26 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.12"]
+        python-version: ["3.14"]
 
     steps:
       - name: Check out repository
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 40a9be3..1032f58 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -26,7 +26,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.14"
 
       - name: Install docs dependencies
         run: |
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
index 4be3b13..6590a7d 100644
--- a/.github/workflows/pylint.yml
+++ b/.github/workflows/pylint.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.12"]
+        python-version: ["3.14"]
     steps:
     - uses: actions/checkout@v4
 
diff --git a/.gitignore b/.gitignore
index 9924d0c..335c6eb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -151,3 +151,7 @@ cython_debug/
 
 # MacOS
 .DS_Store
+
+# Resolved dependency set, recorded per host. Committed at integration, when
+# both hosts have to match.
+uv.lock
diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..6324d40
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.14
diff --git a/README.md b/README.md
index 918eb45..f297b5a 100644
--- a/README.md
+++ b/README.md
@@ -47,13 +47,22 @@ cd hispec
 git submodule sync --recursive
 git submodule update --init --recursive
 
-# 3) (Recommended) Create a Python env
-python -m venv .venv
-source .venv/bin/activate  # Windows: .venv\Scripts\activate
+# 3) Create the environment and install, editable
+uv sync
+```
+
+`uv sync` builds `.venv` on the Python named in `.python-version`, installs
+every dependency and puts this package in it editable, so a `git pull` changes
+behaviour without reinstalling. Run commands through `uv run <command>`, or
+activate `.venv` if you prefer.
 
-# 4) Install package(s) for development
-pip install -U pip
-pip install -e ".[dev]"    # falls back to requirements.txt if no pyproject
+`uv.lock` is not committed while the git dependencies deliberately track their
+default branches. It still records which commit of libby, bamboo and the rest
+your checkout resolved to, which is how to tell what you are running. `uv sync`
+reuses that lock once it exists, so pick up a merged dependency change with:
+
+```bash
+uv lock --upgrade && uv sync
 ```
 
 ## Submodules
diff --git a/pyproject.toml b/pyproject.toml
index d05cdd6..057c271 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,7 +16,7 @@ authors = [
     { name="Prakriti Gupta", email="pgupta@astro.caltech.edu" }
 ]
 readme = "README.md"
-requires-python = ">=3.7"
+requires-python = ">=3.10"
 dependencies = [
     "keyring",
     "pipython",
diff --git a/systemd/install.sh b/systemd/install.sh
index 225c28f..906f674 100755
--- a/systemd/install.sh
+++ b/systemd/install.sh
@@ -20,6 +20,18 @@ set -euo pipefail
 REPO_DIR="${HISPEC_REPO_DIR:-/opt/hispec/app}"
 VENV_DIR="${HISPEC_VENV_DIR:-/opt/hispec/venv}"
 OPS_USERS="${HISPEC_OPS_USERS:-} $*"
+UV_VERSION="${HISPEC_UV_VERSION:-0.12.23}"
+# Its own copy rather than whatever uv is on PATH, since a snap refreshes
+# itself and would unpin the resolver
+UV_BIN=/usr/local/bin/uv
+
+# Keeps uv out of .venv and on the path every unit already references
+export UV_PROJECT_ENVIRONMENT="$VENV_DIR"
+
+# The daemons run as `hispec`, and this script runs as root, so a uv-managed
+# interpreter would land under root's home where they could not read it. Use
+# the system Python, as `python3 -m venv` did.
+export UV_NO_MANAGED_PYTHON=1
 
 if [[ $EUID -ne 0 ]]; then
     echo "Run as root (sudo)." >&2
@@ -96,14 +108,22 @@ fi
 chown root:hispec-ops /etc/hispec/host
 chmod 0644 /etc/hispec/host
 
-# Python environment (editable install so `git pull` picks up code changes
-# without reinstalling).
-if [[ ! -x "$VENV_DIR/bin/python3" ]]; then
-    python3 -m venv "$VENV_DIR"
-    echo "created venv at $VENV_DIR"
+# Pinned, so re-running the installer cannot resolve with a different uv
+if [[ "$("$UV_BIN" --version 2>/dev/null)" != "uv $UV_VERSION"* ]]; then
+    curl -LsSf "https://astral.sh/uv/$UV_VERSION/install.sh" |
+        env UV_INSTALL_DIR=/usr/local/bin UV_NO_MODIFY_PATH=1 sh
+    echo "installed uv $UV_VERSION at $UV_BIN"
 fi
-"$VENV_DIR/bin/pip" install -U pip
-"$VENV_DIR/bin/pip" install -e "$REPO_DIR"
+
+# Python environment (editable install so `git pull` picks up code changes
+# without reinstalling). Upgrade the lock first: the git dependencies track
+# their default branch deliberately, and a reinstall is how a merged libby fix
+# reaches a host.
+(
+    cd "$REPO_DIR"
+    "$UV_BIN" lock --upgrade
+    "$UV_BIN" sync
+)
 chown -R hispec:hispec "$VENV_DIR"
 
 # Unit file + polkit rule (grants hispec-ops members start/stop/restart on