diff --git a/.mise/tasks/python_min_version b/.mise/tasks/python_min_version
index 7c6bade..b1a1f7c 100755
--- a/.mise/tasks/python_min_version
+++ b/.mise/tasks/python_min_version
@@ -1,4 +1,4 @@
-#!/usr/bin/env -S uvx --with packaging python
+#!/usr/bin/env -S uvx --with packaging==26.3 python
 # mise description="Print the minimum Python version from pyproject.toml requires-python"
 import tomllib
 from packaging.specifiers import SpecifierSet
diff --git a/mise.lock b/mise.lock
index 61a6983..5d02afa 100644
--- a/mise.lock
+++ b/mise.lock
@@ -221,7 +221,7 @@ version = "25.7.0"
 backend = "pipx:keyring"
 
 [tools."pipx:keyring".options]
-uvx_args = "--with keyrings.google-artifactregistry-auth"
+uvx_args = "--with keyrings.google-artifactregistry-auth==1.1.2"
 
 [[tools.python]]
 version = "3.14.10"
diff --git a/mise.toml b/mise.toml
index fd1d10a..2bf29ab 100644
--- a/mise.toml
+++ b/mise.toml
@@ -4,7 +4,7 @@ adr-tools = "3.0.0"
 "github:minamijoyo/hcledit" = "v0.2.18"
 gh = "2.102.0"
 jq = "1.8.2"
-"pipx:keyring" = { version = "25.7.0", uvx_args = "--with keyrings.google-artifactregistry-auth" }
+"pipx:keyring" = { version = "25.7.0", uvx_args = "--with keyrings.google-artifactregistry-auth==1.1.2" }
 trivy = "0.76.0"
 uv = "0.13.4"
 
diff --git a/pyproject.toml b/pyproject.toml
index 8e77a77..e886d13 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -112,6 +112,7 @@ dev = [
 
 [tool.uv]
 required-version = ">=0.13.4" # CVE-2025-54368, GHSA-w476-p2h3-79g9, GHSA-pqhf-p39g-3x64
+exclude-newer = "5 days" # Same wait as minimumReleaseAge in renovate.json
 override-dependencies = [ # https://github.com/astral-sh/uv/issues/4422
     "nbconvert>=7.17.1",    # fix for CVE-2025-53000
     "pytest>=9.0.2",        # pytest-md-report depends on pytest<9 unnecessarily
diff --git a/renovate.json b/renovate.json
index a764a3c..9c10030 100644
--- a/renovate.json
+++ b/renovate.json
@@ -23,6 +23,18 @@
     "enabled": true,
     "schedule": ["before 5am on monday"]
   },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": [
+        "Pinned PyPI packages in mise tasks, for example: uv tool install keyring==25.7.0 --with pkg==1.2.3.",
+        "This repo is public, so the org custom managers do not apply here."
+      ],
+      "managerFilePatterns": ["/^tasks\\.toml$/", "/^mise\\.toml$/", "/^\\.mise/tasks//"],
+      "matchStrings": ["(?<depName>[A-Za-z0-9][A-Za-z0-9._-]*)==(?<currentValue>\\d[^\\s\"]*)"],
+      "datasourceTemplate": "pypi"
+    }
+  ],
   "packageRules": [
     {
       "description": [
@@ -69,7 +81,7 @@
     },
     {
       "groupName": "mise tools",
-      "matchManagers": ["mise"],
+      "matchManagers": ["mise", "custom.regex"],
       "separateMajorMinor": false
     }
   ]
diff --git a/tasks.toml b/tasks.toml
index fda6d8e..3502b8c 100644
--- a/tasks.toml
+++ b/tasks.toml
@@ -26,7 +26,7 @@ uv run deptry src
 [install]
 description = "Install dev dependencies and pre-commit hooks"
 run = """
-uv tool install keyring --with keyrings.google-artifactregistry-auth
+uv tool install keyring==25.7.0 --with keyrings.google-artifactregistry-auth==1.1.2
 if [ -f uv.lock ]; then
   uv sync --all-extras --frozen
 else
diff --git a/uv.lock b/uv.lock
index e93322e..aec426d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -10,6 +10,10 @@ resolution-markers = [
     "python_full_version < '3.12' or (python_full_version == '3.12.*' and sys_platform != 'emscripten')",
 ]
 
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P5D"
+
 [manifest]
 overrides = [
     { name = "authlib", specifier = ">=1.9.1" },