diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index da66aab..9ff8497 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
           python-version: '3.14'
 
       - name: Run the tests
-        run: uv run --with-requirements requirements.txt tests/test_check_stale_wheels.py
+        run: uv run --with-requirements tools/requirements.txt tests/test_check_stale_wheels.py
 
   test:
     name: "test upload via action"
diff --git a/.github/workflows/stale-wheels.yml b/.github/workflows/stale-wheels.yml
index 332d6d4..59ebfae 100644
--- a/.github/workflows/stale-wheels.yml
+++ b/.github/workflows/stale-wheels.yml
@@ -37,7 +37,7 @@ jobs:
           ISSUE_OPENER_TOKEN: ${{ secrets.ISSUE_OPENER_TOKEN }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          uv run --with-requirements requirements.txt tools/check_stale_wheels.py ${{ inputs.dry_run && '--dry-run' || '' }}
+          uv run --with-requirements tools/requirements.txt tools/check_stale_wheels.py ${{ inputs.dry_run && '--dry-run' || '' }}
 
   report-failure:
     needs: [report]
diff --git a/AGENTS.md b/AGENTS.md
index ffb298c..14711c0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,11 +20,11 @@ It is called as a job rather than used as a composite action because `ci.yml` ch
 
 Pin third-party actions to a full commit SHA with a `# vX.Y.Z` comment; Dependabot updates them monthly as a single group.
 
-Run the Python tools with `uv run --with-requirements requirements.txt <script>`, which is how the workflows invoke them; the scripts carry no PEP 723 header, so that their dependencies are declared in exactly one place.
-That file pins exact versions rather than a `uv.lock`, because Dependabot has no `uv` ecosystem and an unmaintainable lock would only rot, while it does understand `requirements.txt` and proposes updates monthly.
+Run the Python tools with `uv run --with-requirements tools/requirements.txt <script>`, which is how the workflows invoke them; the scripts carry no PEP 723 header, so that their dependencies are declared in exactly one place.
+That file pins exact versions rather than a `uv.lock`, because Dependabot has no `uv` ecosystem and an unmaintainable lock would only rot, while it does understand `tools/requirements.txt` and proposes updates monthly.
 `scientific-python/issue-from-pytest-log-action` is worth reading for the rest of the house style, though it locks its scripts individually where this repository does not.
 
-Pin versions exactly, as `pixi.toml` and `requirements.txt` both do.
+Pin versions exactly, as `pixi.toml` and `tools/requirements.txt` both do.
 Do not add a `[tool.uv] exclude-newer` window to a script whose dependencies Dependabot pins: uv then refuses to resolve any pin newer than the cutoff, leaving every Dependabot pull request unresolvable until the release ages past it.
 The window in `pixi.toml` is fine, because those versions are bumped by hand.
 
diff --git a/requirements.txt b/tools/requirements.txt
similarity index 88%
rename from requirements.txt
rename to tools/requirements.txt
index 225ca2b..6a869ab 100644
--- a/requirements.txt
+++ b/tools/requirements.txt
@@ -1,7 +1,7 @@
 # Dependencies of the Python tools in this repository, and the only place their
 # versions are declared. Run a tool with:
 #
-#     uv run --with-requirements requirements.txt <script>
+#     uv run --with-requirements tools/requirements.txt <script>
 #
 # Pin exactly rather than with a range: Dependabot leaves a range alone while the
 # newest release still satisfies it, so a range would give neither pinning nor