diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7e2c1e9..c0b826b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,10 +1,16 @@
 repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.11
+  - repo: local
     hooks:
       - id: ruff
+        name: ruff (uv.lock)
+        entry: uv run --no-sync ruff check
+        language: system
+        types_or: [python, pyi]
       - id: ruff-format
-        args: [--check]
+        name: ruff format (uv.lock)
+        entry: uv run --no-sync ruff format --check
+        language: system
+        types_or: [python, pyi]
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
diff --git a/pyproject.toml b/pyproject.toml
index 05038c6..6acd339 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -45,5 +45,8 @@ line-length = 100
 target-version = "py313"
 src = ["src", "tests"]
 
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F"]
+
 [tool.ruff.lint.per-file-ignores]
 "src/ai_platform/presentation/http/*.py" = ["B008"]
diff --git a/tests/test_app_admin_api.py b/tests/test_app_admin_api.py
index 1bcd447..ebbe02b 100644
--- a/tests/test_app_admin_api.py
+++ b/tests/test_app_admin_api.py
@@ -71,7 +71,10 @@ def test_operator_lifecycle_and_admin_session_revoke():
             assert initial_key not in listed.text and "verifier" not in listed.text
             assert client.delete(path).status_code == 403
             run_path = f"/v1/lead-scoring/runs/{uuid4()}"
-            auth = lambda key: {"Authorization": f"Bearer {key}"}
+
+            def auth(key: str) -> dict[str, str]:
+                return {"Authorization": f"Bearer {key}"}
+
             assert client.get(run_path, headers=auth(initial_key)).status_code == 404
             rotated_key = asyncio.run(rotate())
             assert rotated_key != initial_key
diff --git a/tests/test_seed_demo.py b/tests/test_seed_demo.py
index f550fc8..5a381ca 100644
--- a/tests/test_seed_demo.py
+++ b/tests/test_seed_demo.py
@@ -146,6 +146,7 @@ def test_seed_rejects_readback_without_persisted_snapshot():
         seed_demo.seed_demo(client, settings(), "existing-app-secret")
 
 
+@pytest.mark.usefixtures("isolated_settings")
 def test_seed_refuses_non_development_or_nonlocal_database_names():
     with pytest.raises(SystemExit, match="must be development"):
         seed_demo.validate_local_target(Settings(environment="production"))