diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a87482f..2dfc5f3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,7 +104,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install build tools
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Validate release inputs
         id: release
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 9d4f366..2205ce3 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -187,7 +187,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install uv
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Validate lockfile
         run: uv lock --check
@@ -243,7 +243,7 @@ jobs:
             uv-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-
 
       - name: Install uv
-        run: python -m pip install "uv==${UV_VERSION}"
+        run: python -m pip install --uploaded-prior-to P3D "uv==${UV_VERSION}"
 
       - name: Build distributions
         run: |
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..ec9e05d
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+min-release-age=3
diff --git a/AGENTS.md b/AGENTS.md
index 86e69f5..3b03862 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -241,6 +241,10 @@ Business workflows live in packages:
 - `uv run pyright` must be clean. No `# type: ignore` to silence -
   fix the underlying type.
 - Local tests use stdlib `unittest`: `uv run python -m unittest discover -s tests`.
+- Dependencies wait 3 days after release: `minimumReleaseAge` in
+  `renovate.json` (`src-py-lib` is exempt), `min-release-age` in `.npmrc`, and
+  `--uploaded-prior-to P3D` where workflows `pip install` uv. pip reports a
+  younger pin as `No matching distribution found`.
 - For Sourcegraph mutation-path changes, also verify by dry-running `--get` /
   `--set` / `--restore` against a real instance and diffing. If the expected
   changes look right, run `--apply` against a scratch instance and inspect
diff --git a/renovate.json b/renovate.json
index 1dab464..523beb5 100644
--- a/renovate.json
+++ b/renovate.json
@@ -10,6 +10,7 @@
       "before 4am"
     ]
   },
+  "minimumReleaseAge": "3 days",
   "osvVulnerabilityAlerts": true,
   "packageRules": [
     {
@@ -18,6 +19,13 @@
       ],
       "groupName": "build requirements"
     },
+    {
+      "description": "First-party package, no cooldown",
+      "matchPackageNames": [
+        "src-py-lib"
+      ],
+      "minimumReleaseAge": null
+    },
     {
       "matchPackageNames": [
         "python"