diff --git a/.evergreen/run-mongodb-aws-ecs-test.sh b/.evergreen/run-mongodb-aws-ecs-test.sh
index 414c7a0a25..d2e0f07dd0 100755
--- a/.evergreen/run-mongodb-aws-ecs-test.sh
+++ b/.evergreen/run-mongodb-aws-ecs-test.sh
@@ -24,6 +24,10 @@ apt-get -qq update  < /dev/null > /dev/null
 apt-get -q install -y build-essential
 
 export SET_XTRACE_ON=1
+export CI=true
+# Install from the uv.lock generated on the host (which has git); this
+# container doesn't, so it must not try to resolve mockupdb itself.
+export UV_FROZEN=1
 cd src
 rm -rf .venv
 rm -f .evergreen/scripts/test-env.sh || true
diff --git a/.evergreen/run-tests.sh b/.evergreen/run-tests.sh
index 4ec527c941..52d2da31eb 100755
--- a/.evergreen/run-tests.sh
+++ b/.evergreen/run-tests.sh
@@ -27,6 +27,11 @@ else
 fi
 
 # Start the test runner.
+# UV_FROZEN means a uv.lock was already generated where git is available
+# (e.g. for the ecs remote host); don't fight it by disabling lock usage.
+if [ -z "${UV_FROZEN:-}" ]; then
+  export UV_NO_LOCK=1
+fi
 echo "Running tests with UV_PYTHON=${UV_PYTHON:-}..."
 echo "UV_ARGS=${UV_ARGS}"
 uv run ${UV_ARGS} --reinstall-package pymongo .evergreen/scripts/run_tests.py "$@"
diff --git a/.evergreen/scripts/configure-env.sh b/.evergreen/scripts/configure-env.sh
index 8c871d516b..54ddc4c136 100755
--- a/.evergreen/scripts/configure-env.sh
+++ b/.evergreen/scripts/configure-env.sh
@@ -18,12 +18,6 @@ UV_TOOL_DIR=$PROJECT_DIRECTORY/.local/uv/tools
 UV_CACHE_DIR=$PROJECT_DIRECTORY/.local/uv/cache
 DRIVERS_TOOLS_BINARIES="$DRIVERS_TOOLS/.bin"
 MONGODB_BINARIES="$DRIVERS_TOOLS/mongodb/bin"
-# GNU date on Linux and Windows, BSD date on macOS.
-UV_EXCLUDE_NEWER="$(date -u -d '7 days ago' +%Y-%m-%d 2>/dev/null || date -u -v-7d +%Y-%m-%d)"
-if [ -z "$UV_EXCLUDE_NEWER" ]; then
-  echo "Failed to compute UV_EXCLUDE_NEWER" >&2
-  exit 1
-fi
 
 # On Evergreen jobs, "CI" will be set, and we don't want to write to $HOME.
 if [ "${CI:-}" == "true" ]; then
@@ -72,7 +66,6 @@ export UV_TOOL_DIR="$UV_TOOL_DIR"
 export UV_CACHE_DIR="$UV_CACHE_DIR"
 export UV_TOOL_BIN_DIR="$DRIVERS_TOOLS_BINARIES"
 export UV_NO_LOCK=1
-export UV_EXCLUDE_NEWER="$UV_EXCLUDE_NEWER"
 export PYMONGO_BIN_DIR="$PYMONGO_BIN_DIR"
 export PATH="$PATH_EXT"
 # shellcheck disable=SC2154
diff --git a/.evergreen/scripts/kms_tester.py b/.evergreen/scripts/kms_tester.py
index 65c0f3fc92..093921e0a7 100644
--- a/.evergreen/scripts/kms_tester.py
+++ b/.evergreen/scripts/kms_tester.py
@@ -33,7 +33,7 @@ def _setup_azure_vm(base_env: dict[str, str]) -> None:
     env["AZUREKMS_CMD"] = "sudo apt-get install -y python3-dev build-essential"
     run_command(f"{azure_dir}/run-command.sh", env=env)
 
-    env["AZUREKMS_CMD"] = "bash .evergreen/just.sh setup-tests kms azure-remote"
+    env["AZUREKMS_CMD"] = "CI=true bash .evergreen/just.sh setup-tests kms azure-remote"
     run_command(f"{azure_dir}/run-command.sh", env=env)
     LOGGER.info("Setting up Azure VM... done.")
 
@@ -53,7 +53,7 @@ def _setup_gcp_vm(base_env: dict[str, str]) -> None:
     env["GCPKMS_CMD"] = "sudo apt-get install -y python3-dev build-essential"
     run_command(f"{gcp_dir}/run-command.sh", env=env)
 
-    env["GCPKMS_CMD"] = "bash ./.evergreen/just.sh setup-tests kms gcp-remote"
+    env["GCPKMS_CMD"] = "CI=true bash ./.evergreen/just.sh setup-tests kms gcp-remote"
     run_command(f"{gcp_dir}/run-command.sh", env=env)
     LOGGER.info("Setting up GCP VM...")
 
@@ -128,10 +128,10 @@ def test_kms_send_to_remote(sub_test_name: str) -> None:
         key_name = os.environ["KEY_NAME"]
         key_vault_endpoint = os.environ["KEY_VAULT_ENDPOINT"]
         env["AZUREKMS_CMD"] = (
-            f'KEY_NAME="{key_name}" KEY_VAULT_ENDPOINT="{key_vault_endpoint}" bash ./.evergreen/just.sh run-tests'
+            f'KEY_NAME="{key_name}" KEY_VAULT_ENDPOINT="{key_vault_endpoint}" CI=true bash ./.evergreen/just.sh run-tests'
         )
     else:
-        env["GCPKMS_CMD"] = "./.evergreen/just.sh run-tests"
+        env["GCPKMS_CMD"] = "CI=true ./.evergreen/just.sh run-tests"
     cmd = f"{DIRS[sub_test_name]}/run-command.sh"
     run_command(cmd, env=env)
 
diff --git a/.evergreen/scripts/run_tests.py b/.evergreen/scripts/run_tests.py
index 49986c67ab..421be30c13 100644
--- a/.evergreen/scripts/run_tests.py
+++ b/.evergreen/scripts/run_tests.py
@@ -182,6 +182,10 @@ def run() -> None:
 
     # Send ecs tests to run remotely.
     if TEST_NAME == "auth_aws" and SUB_TEST_NAME == "ecs":
+        # Lock dependencies here, where git is available, so the ecs
+        # container (which has no git) can install from the lock frozen,
+        # without needing to resolve mockupdb's git dependency itself.
+        run_command("uv lock", cwd=ROOT)
         run_command(f"{DRIVERS_TOOLS}/.evergreen/auth_aws/aws_setup.sh ecs")
         return
 
diff --git a/.evergreen/scripts/setup-dev-env.sh b/.evergreen/scripts/setup-dev-env.sh
index 0b738e4a67..83b1b622b4 100755
--- a/.evergreen/scripts/setup-dev-env.sh
+++ b/.evergreen/scripts/setup-dev-env.sh
@@ -22,13 +22,13 @@ fi
 # Ensure dependencies are installed.
 bash $HERE/install-dependencies.sh
 
+# Add the default install path to the path if needed.
+if [ -z "${PYMONGO_BIN_DIR:-}" ]; then
+  export PATH="$PATH:$HOME/.local/bin"
+fi
+
 # Only run the next part if not running on CI.
 if [ -z "${CI:-}" ]; then
-  # Add the default install path to the path if needed.
-  if [ -z "${PYMONGO_BIN_DIR:-}" ]; then
-    export PATH="$PATH:$HOME/.local/bin"
-  fi
-
   # Set up venv, making sure c extensions build unless disabled.
   if [ -z "${NO_EXT:-}" ]; then
     export PYMONGO_C_EXT_MUST_BUILD=1
diff --git a/.evergreen/scripts/setup-tests.sh b/.evergreen/scripts/setup-tests.sh
index 858906a39e..8193fb2cec 100755
--- a/.evergreen/scripts/setup-tests.sh
+++ b/.evergreen/scripts/setup-tests.sh
@@ -21,6 +21,12 @@ if [ -f $SCRIPT_DIR/env.sh ]; then
   source $SCRIPT_DIR/env.sh
 fi
 
+# UV_FROZEN means a uv.lock was already generated where git is available
+# (e.g. for the ecs remote host); don't fight it by disabling lock usage.
+if [ -z "${UV_FROZEN:-}" ]; then
+  export UV_NO_LOCK=1
+fi
+
 echo "Setting up tests with args \"$*\"..."
 uv run ${USE_ACTIVE_VENV:+--active} "$SCRIPT_DIR/setup_tests.py" "$@"
 echo "Setting up tests with args \"$*\"... done."
diff --git a/justfile b/justfile
index ad0a0af1a9..f6f10ca5a9 100644
--- a/justfile
+++ b/justfile
@@ -3,9 +3,6 @@ set shell := ["bash", "-c"]
 
 # Don't let `uv` create or read uv.lock.
 export UV_NO_LOCK := "1"
-# Match CI's resolution window so local installs agree.
-# GNU date on Linux and Windows, BSD date on macOS.
-export UV_EXCLUDE_NEWER := `date -u -d '7 days ago' +%Y-%m-%d 2>/dev/null || date -u -v-7d +%Y-%m-%d`
 
 # Commonly used command segments.
 typing_run := "uv run --group typing --extra aws --extra encryption --with numpy --extra ocsp --extra snappy --extra test --extra zstd"
diff --git a/pyproject.toml b/pyproject.toml
index 5922a4aa2c..0fb042c256 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -46,6 +46,13 @@ Documentation = "https://www.mongodb.com/docs/languages/python/pymongo-driver/cu
 Source = "https://github.com/mongodb/mongo-python-driver"
 Tracker = "https://jira.mongodb.org/projects/PYTHON/issues"
 
+[tool.uv]
+# Only sync the (empty) dev group by default; groups like mockupdb require
+# an explicit --group flag so hosts without git aren't forced to resolve it.
+default-groups = ["dev"]
+# Wait 7 days before resolving newly published package versions.
+exclude-newer = "7 days"
+
 [dependency-groups]
 dev = []
 lint = [