diff --git a/python/README.md b/python/README.md
index 1f04b4d..f9a4a18 100644
--- a/python/README.md
+++ b/python/README.md
@@ -15,8 +15,15 @@ repos repeat in every CI job.
 ```
 
 Python comes from `actions/setup-python`, which is faster than having uv download
-a managed interpreter. uv is then pinned to that interpreter through `UV_PYTHON`,
-so the project's `pyproject.toml` and `.python-version` do not change the choice.
+a managed interpreter. The action then exports `UV_PYTHON` as the requested
+version, so the project's `pyproject.toml` and `.python-version` do not change
+the choice, and `UV_PYTHON_PREFERENCE=only-system`, so uv never downloads an
+interpreter of its own.
+
+`UV_PYTHON` holds a version rather than an interpreter path. A path would also
+outrank a virtual environment that the job activates later, so a job doing its
+own `uv venv` would find `uv pip install` targeting the interpreter behind its
+back.
 
 The action runs no just recipes. A job that needs project dependencies runs its
 own `just install` step after this one.
diff --git a/python/setup/action.yml b/python/setup/action.yml
index ce2e554..93699b7 100644
--- a/python/setup/action.yml
+++ b/python/setup/action.yml
@@ -16,20 +16,22 @@ runs:
   steps:
     # Runner images already ship these versions, so uv downloads no interpreter.
     - name: Install Python
-      id: setup-python
       uses: actions/setup-python@v7
       with:
         python-version: ${{ inputs.python-version }}
         allow-prereleases: ${{ inputs.allow-prereleases }}
 
-    - name: Point uv at that interpreter
+    - name: Point uv at that Python
       shell: bash
       env:
-        PYTHON_PATH: ${{ steps.setup-python.outputs.python-path }}
+        PYTHON_VERSION: ${{ inputs.python-version }}
       # GITHUB_ENV is the only way a composite action exports to later steps.
       run: | # zizmor: ignore[github-env]
-        # An absolute path pins uv here, ignoring .python-version.
-        echo "UV_PYTHON=$PYTHON_PATH" >> "$GITHUB_ENV"
+        # A version, not an interpreter path: a path also outranks a virtual
+        # environment the job activates later, which silently retargets `uv pip`.
+        echo "UV_PYTHON=$PYTHON_VERSION" >> "$GITHUB_ENV"
+        # setup-python already provided the interpreter, so never download one.
+        echo "UV_PYTHON_PREFERENCE=only-system" >> "$GITHUB_ENV"
 
     - name: Install uv
       uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1