diff --git a/.github/workflows/ci-flatpak.yml b/.github/workflows/ci-flatpak.yml
index a7570aaabcd..cde5248e1c0 100644
--- a/.github/workflows/ci-flatpak.yml
+++ b/.github/workflows/ci-flatpak.yml
@@ -61,10 +61,15 @@ jobs:
 
       - name: Sync Python tools
         run: |
-          uv sync --locked --only-group flatpak \
-            --python "${PYTHON_VERSION}" \
-            --no-python-downloads \
+          uv_sync_args=(
+            --locked
+            --only-group flatpak
+            --python "${PYTHON_VERSION}"
+            --no-python-downloads
             --no-install-project
+          )
+          # uv.lock pins external artifacts; reviewed local Flatpak generator build hooks are required.
+          uv sync "${uv_sync_args[@]}"  # NOSONAR(githubactions:S8541, githubactions:S8544)
 
       - name: Setup Dependencies Linux Flatpak
         run: |
@@ -88,7 +93,7 @@ jobs:
 
       - name: flatpak node generator
         # https://github.com/flatpak/flatpak-builder-tools/blob/master/node/README.md
-        run: uv run --locked --no-sync python -m flatpak_node_generator npm package-lock.json
+        run: uv run --locked --no-build --no-sync python -m flatpak_node_generator npm package-lock.json
 
       - name: Debug generated-sources.json
         run: cat generated-sources.json
@@ -105,7 +110,7 @@ jobs:
             --no-header \
             --output-file glad-requirements.txt
 
-          uv run --locked --no-sync python \
+          uv run --locked --no-build --no-sync python \
             ./packaging/linux/flatpak/deps/flatpak-builder-tools/pip/flatpak-pip-generator.py \
             --runtime="org.kde.Sdk//${KDE_PLATFORM_VERSION}" \
             --output glad-dependencies \
diff --git a/.github/workflows/ci-freebsd.yml b/.github/workflows/ci-freebsd.yml
index a6eaac3e66a..5466c72aace 100644
--- a/.github/workflows/ci-freebsd.yml
+++ b/.github/workflows/ci-freebsd.yml
@@ -105,11 +105,23 @@ jobs:
             set -e
             # Keep FreeBSD off Sunshine's default dependency path: lizardbyte-common[c]
             # includes clang-format, which has no FreeBSD wheel and is slow to build.
-            uv sync --locked --only-group glad --python "/usr/local/bin/python${PYTHON_VERSION}" \
-              --no-python-downloads --no-install-project
-            uv sync --project third-party/lizardbyte-common --locked --only-group test-c \
+            set -- \
+              --locked \
+              --only-group glad \
               --python "/usr/local/bin/python${PYTHON_VERSION}" \
-              --no-python-downloads --no-install-project
+              --no-python-downloads \
+              --no-install-project
+            # uv.lock pins external artifacts; the reviewed vendored glad2 build hook is required.
+            uv sync "$@"  # NOSONAR(githubactions:S8541, githubactions:S8544)
+            set -- \
+              --project third-party/lizardbyte-common \
+              --locked \
+              --only-group test-c \
+              --python "/usr/local/bin/python${PYTHON_VERSION}" \
+              --no-python-downloads \
+              --no-install-project
+            # uv.lock pins the source artifact; FreeBSD must build lxml because no wheel is available.
+            uv sync "$@"  # NOSONAR(githubactions:S8541, githubactions:S8544)
 
             # fix git safe.directory issues
             git config --global --add safe.directory "*"
diff --git a/.github/workflows/ci-macos.yml b/.github/workflows/ci-macos.yml
index 0b555bb4fc1..85f803e607f 100644
--- a/.github/workflows/ci-macos.yml
+++ b/.github/workflows/ci-macos.yml
@@ -111,9 +111,14 @@ jobs:
 
       - name: Sync Python tools
         run: |
-          uv sync --locked \
-            --python "${PYTHON_VERSION}" \
-            --no-python-downloads --no-install-project
+          uv_sync_args=(
+            --locked
+            --python "${PYTHON_VERSION}"
+            --no-python-downloads
+            --no-install-project
+          )
+          # uv.lock pins external artifacts; the reviewed local lizardbyte-common build hook is required.
+          uv sync "${uv_sync_args[@]}"  # NOSONAR(githubactions:S8541, githubactions:S8544)
 
       - name: Configure
         env:
diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index c3c89618cfc..417464ded6f 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -128,7 +128,7 @@ jobs:
             tarball="${pkg}-${version}-any.pkg.tar.zst"
 
             # download working version
-            wget "https://repo.msys2.org/mingw/${MATRIX_MSYSTEM}/${tarball}"
+            wget --max-redirect=0 "https://repo.msys2.org/mingw/${MATRIX_MSYSTEM}/${tarball}"
 
             tarballs="${tarballs} ${tarball}"
           done
@@ -215,9 +215,13 @@ jobs:
           MSYS2_PATH_TYPE: inherit
           UV_PYTHON: ${{ steps.setup-python.outputs.python-path }}
         run: |
-          uv sync --locked \
-            --no-python-downloads \
+          uv_sync_args=(
+            --locked
+            --no-python-downloads
             --no-install-project
+          )
+          # uv.lock pins external artifacts; the reviewed local lizardbyte-common build hook is required.
+          uv sync "${uv_sync_args[@]}"  # NOSONAR(githubactions:S8541, githubactions:S8544)
 
       - name: Build Windows
         shell: msys2 {0}
@@ -385,7 +389,7 @@ jobs:
         env:
           MSYS2_PATH_TYPE: inherit
         run: |
-          uv run --project .. --locked --no-sync gcovr . -r ../src \
+          uv run --project .. --locked --no-build --no-sync gcovr . -r ../src \
             --exclude-noncode-lines \
             --exclude-throw-branches \
             --exclude-unreachable-branches \
diff --git a/docker/clion-toolchain.dockerfile b/docker/clion-toolchain.dockerfile
index b8a06cfe6c2..e97c156d1c5 100644
--- a/docker/clion-toolchain.dockerfile
+++ b/docker/clion-toolchain.dockerfile
@@ -79,7 +79,7 @@ fi
 url="${cuda_prefix}${CUDA_VERSION}/local_installers/cuda_${CUDA_VERSION}_${CUDA_BUILD}_linux${cuda_suffix}.run"
 echo "cuda url: ${url}"
 tmpfile="/tmp/cuda.run"
-wget "$url" --progress=bar:force:noscroll --show-progress -O "$tmpfile"
+wget "$url" --max-redirect=0 --progress=bar:force:noscroll --show-progress -O "$tmpfile"
 chmod a+x "${tmpfile}"
 "${tmpfile}" --silent --toolkit --toolkitpath=/usr/local --no-opengl-libs --no-man-page --no-drm
 rm -f "${tmpfile}"
diff --git a/scripts/linux_build.sh b/scripts/linux_build.sh
index 500cf9c8ce7..5254a97c031 100755
--- a/scripts/linux_build.sh
+++ b/scripts/linux_build.sh
@@ -537,7 +537,7 @@ function install_cuda() {
 
   local url="${cuda_prefix}${cuda_version}/local_installers/cuda_${cuda_version}_${cuda_build}_linux${cuda_suffix}.run"
   echo "cuda url: ${url}"
-  wget "$url" --progress=bar:force:noscroll -q --show-progress -O "${build_dir}/cuda.run"
+  wget "$url" --max-redirect=0 --progress=bar:force:noscroll -q --show-progress -O "${build_dir}/cuda.run"
   chmod a+x "${build_dir}/cuda.run"
   "${build_dir}/cuda.run" --silent --toolkit --toolkitpath="${build_dir}/cuda" --no-opengl-libs --no-man-page --no-drm "$cuda_override_arg"
   rm "${build_dir}/cuda.run"
@@ -631,7 +631,16 @@ function run_step_deps() {
       doxygen_url="https://github.com/doxygen/doxygen/releases/download/Release_${_doxygen_min}/${DOXYGEN}-${doxygen_min}.src.tar.gz"
       echo "${DOXYGEN} url: ${doxygen_url}"
       pushd "${build_dir}"
-        wget "$doxygen_url" --progress=bar:force:noscroll -q --show-progress -O "${DOXYGEN}.tar.gz"
+        local -a doxygen_download_args=(
+          "$doxygen_url"
+          --max-redirect=1
+          --progress=bar:force:noscroll
+          -q
+          --show-progress
+          -O "${DOXYGEN}.tar.gz"
+        )
+        # GitHub release downloads require one redirect to the release asset host.
+        wget "${doxygen_download_args[@]}"  # NOSONAR(shell:S6506)
         tar -xzf "${DOXYGEN}.tar.gz"
         cd "${DOXYGEN}-${doxygen_min}"
         cmake -DCMAKE_BUILD_TYPE=Release -G="Ninja" -B="build" -S="."
@@ -648,7 +657,7 @@ function run_step_deps() {
   if [[ "$nvm_node" == 1 ]]; then
     nvm_url="https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh"
     echo "nvm url: ${nvm_url}"
-    wget -qO- ${nvm_url} | bash
+    wget --max-redirect=0 -qO- ${nvm_url} | bash
 
     # shellcheck source=/dev/null  # we don't care that shellcheck cannot find nvm.sh
     source "$HOME/.nvm/nvm.sh"