diff --git a/pyproject.toml b/pyproject.toml
index 5e3dede..d06fd58 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -50,6 +50,14 @@ version = {attr = "jubilant.__version__"}
 [tool.setuptools]
 license-files = []
 
+[tool.uv]
+# Rolling quarantine: never resolve against packages published in the last 7
+# days, so a compromised release has a window to be caught/yanked upstream
+# before it can reach this project via a manual `uv add`, a `uv lock` regen,
+# a uvx bootstrap, or a CI re-resolve. Complements (doesn't replace) the
+# Dependabot cooldown, which only protects Dependabot-authored PRs.
+exclude-newer = "7 days"
+
 # Linting tools configuration
 [tool.ruff]
 line-length = 99