diff --git a/.github/workflows/dc_sync.yml b/.github/workflows/dc_sync.yml
index 616e95c..b12b6f0 100644
--- a/.github/workflows/dc_sync.yml
+++ b/.github/workflows/dc_sync.yml
@@ -46,14 +46,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - name: Setup Python and uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.11"
 
       - name: Install requirements
+        env:
+          UV_EXCLUDE_NEWER: P3D  # reject packages uploaded within the last 3 days (supply chain protection)
         run: |
-          pip install --upgrade pip
-          pip install -r requirements.txt
+          uv venv
+          uv pip install -r requirements.txt
 
       - name: Generate file to upload
         id: file-generator
@@ -62,6 +65,7 @@ jobs:
           METADATA_FILE="$(basename ${{ matrix.file }} .ipynb).yml"
           echo "file=text/$FILE" >> "$GITHUB_OUTPUT"
           echo "metadata_file=text/$METADATA_FILE" >> "$GITHUB_OUTPUT"
+          . .venv/bin/activate
           python scripts/generate_txt.py --metadata --notebooks ${{ matrix.file }}
 
       - name: Upload tutorial to deepset Cloud
diff --git a/.github/workflows/full_dc_sync.yml b/.github/workflows/full_dc_sync.yml
index e05dcde..abb9866 100644
--- a/.github/workflows/full_dc_sync.yml
+++ b/.github/workflows/full_dc_sync.yml
@@ -10,20 +10,27 @@ jobs:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      - name: Setup Python and uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: "3.11"
 
       - name: Install requirements
+        env:
+          UV_EXCLUDE_NEWER: P3D  # reject packages uploaded within the last 3 days (supply chain protection)
         run: |
-          pip install --upgrade pip
-          pip install -r requirements.txt
+          uv venv
+          uv pip install -r requirements.txt
 
       - name: Generate all tutorials and their metadata
-        run: python scripts/generate_txt.py --notebooks all --metadata
+        run: |
+          . .venv/bin/activate
+          python scripts/generate_txt.py --notebooks all --metadata
 
       - name: Full sync
         env:
           DEEPSET_CLOUD_WORKSPACE: ${{ secrets.DEEPSET_CLOUD_WORKSPACE }}
           DEEPSET_CLOUD_API_KEY: ${{ secrets.DEEPSET_CLOUD_API_KEY }}
-        run: python scripts/full_dc_sync.py
+        run: |
+          . .venv/bin/activate
+          python scripts/full_dc_sync.py
diff --git a/.github/workflows/run_tutorials.yml b/.github/workflows/run_tutorials.yml
index d0487cf..9783095 100644
--- a/.github/workflows/run_tutorials.yml
+++ b/.github/workflows/run_tutorials.yml
@@ -97,10 +97,12 @@ jobs:
             VERSION="${{ matrix.haystack_version }}"
             uv pip install "haystack-ai==${VERSION#v}"
           fi
-          uv pip install nbconvert ipython
+          uv pip install --exclude-newer P3D nbconvert ipython  # P3D = 3-day cutoff; haystack-ai above is exempt
 
       - name: Install tutorial dependencies
         if: toJSON(matrix.dependencies) != '[]'
+        env:
+          UV_EXCLUDE_NEWER: P3D  # reject packages uploaded within the last 3 days (supply chain protection)
         run: |
           uv pip install "${{ join(matrix.dependencies, '" "')}}"
 
diff --git a/.github/workflows/verify_generation.yml b/.github/workflows/verify_generation.yml
index 242dcc0..f195eee 100644
--- a/.github/workflows/verify_generation.yml
+++ b/.github/workflows/verify_generation.yml
@@ -19,6 +19,8 @@ jobs:
           python-version: "3.11"
 
       - name: Install dependencies
+        env:
+          UV_EXCLUDE_NEWER: P3D  # reject packages uploaded within the last 3 days (supply chain protection)
         run: |
           uv venv
           uv pip install -r requirements.txt