diff --git a/devbox_setup.md b/devbox_setup.md
index d5756823c..ed8659a7e 100644
--- a/devbox_setup.md
+++ b/devbox_setup.md
@@ -21,7 +21,7 @@ uv run pre-commit install
 
 `uv sync` installs the SDK and all development dependency groups into `.venv`. Source changes are immediately reflected because the SDK and `dev_utils` are installed editably.
 
-The checked-in `uv.lock` provides a reproducible contributor environment. CI deliberately runs `uv sync --upgrade` so the library is also tested against the newest compatible dependencies.
+The checked-in `uv.lock` provides a reproducible contributor environment. Cached Azure Pipelines E2E jobs deliberately resolve an upgraded lockfile before caching, then run `uv sync --locked` so the library is tested against the newest compatible dependencies without changing the cache key during a job.
 
 Common commands:
 
diff --git a/vsts/build.yaml b/vsts/build.yaml
index 717fd2e37..a44675320 100644
--- a/vsts/build.yaml
+++ b/vsts/build.yaml
@@ -4,9 +4,10 @@ trigger:
     - main
 
 pr:
+  autoCancel: true
   branches:
     include:
-    - main
+    - '*'
 
 resources:
 - repo: self
diff --git a/vsts/dps-e2e.yaml b/vsts/dps-e2e.yaml
index 863bc9621..bed45ee66 100644
--- a/vsts/dps-e2e.yaml
+++ b/vsts/dps-e2e.yaml
@@ -4,9 +4,10 @@ trigger:
     - main
 
 pr:
+  autoCancel: true
   branches:
     include:
-    - main
+    - '*'
 
 resources:
 - repo: self
@@ -287,6 +288,13 @@ stages:
         versionSpec: '3.10'
         architecture: 'x64'
 
+    - script: 'python -m pip install uv'
+      displayName: 'Install uv'
+
+    # Resolve upgrades before Cache@2 hashes uv.lock so its save key stays stable.
+    - script: 'uv lock --upgrade --python 3.10 --no-cache'
+      displayName: 'Resolve latest dependencies'
+
     # Cache downloads without reusing the job environment.
     - task: Cache@2
       displayName: 'Cache uv'
@@ -297,10 +305,7 @@ stages:
           "uv" | "$(Agent.OS)"
         path: $(Pipeline.Workspace)/.uv-cache
 
-    - script: 'python -m pip install uv'
-      displayName: 'Install uv'
-
-    - script: 'uv sync --upgrade --python 3.10 --no-dev --group test --group e2e'
+    - script: 'uv sync --locked --python 3.10 --no-dev --group test --group e2e'
       displayName: 'Sync E2E environment'
       env:
         UV_CACHE_DIR: $(Pipeline.Workspace)/.uv-cache
diff --git a/vsts/horton-e2e.yaml b/vsts/horton-e2e.yaml
index ea96a34b8..0ca5d24e9 100644
--- a/vsts/horton-e2e.yaml
+++ b/vsts/horton-e2e.yaml
@@ -4,9 +4,10 @@ trigger:
     - main
 
 pr:
+  autoCancel: true
   branches:
     include:
-    - main
+    - '*'
 
 variables:
   Horton.FrameworkRoot: $(Agent.BuildDirectory)/e2e-fx
diff --git a/vsts/python-canary.yaml b/vsts/python-canary.yaml
index 0edc2cfae..17164ed2e 100644
--- a/vsts/python-canary.yaml
+++ b/vsts/python-canary.yaml
@@ -52,6 +52,13 @@ jobs:
         versionSpec: $(pv)
         architecture: 'x64'
 
+    - script: 'python -m pip install uv'
+      displayName: 'Install uv'
+
+    # Resolve upgrades before Cache@2 hashes uv.lock so its save key stays stable.
+    - script: 'uv lock --upgrade --python "$(pv)" --no-cache'
+      displayName: 'Resolve latest dependencies'
+
     # Cache downloads without reusing the job environment.
     - task: Cache@2
       displayName: 'Cache uv'
@@ -62,10 +69,7 @@ jobs:
           "uv" | "$(Agent.OS)"
         path: $(Pipeline.Workspace)/.uv-cache
 
-    - script: 'python -m pip install uv'
-      displayName: 'Install uv'
-
-    - script: 'uv sync --upgrade --python "$(pv)" --no-dev --group test --group e2e'
+    - script: 'uv sync --locked --python "$(pv)" --no-dev --group test --group e2e'
       displayName: 'Sync E2E environment'
       env:
         UV_CACHE_DIR: $(Pipeline.Workspace)/.uv-cache
@@ -84,4 +88,3 @@ jobs:
     - task: PublishTestResults@2
       displayName: 'Publish Test Results'
       condition: always()
-
diff --git a/vsts/python-e2e.yaml b/vsts/python-e2e.yaml
index 304036db0..ad60f0667 100644
--- a/vsts/python-e2e.yaml
+++ b/vsts/python-e2e.yaml
@@ -4,9 +4,10 @@ trigger:
     - main
 
 pr:
+  autoCancel: true
   branches:
     include:
-    - main
+    - '*'
 
 name: $(BuildID)_$(BuildDefinitionName)_$(SourceBranchName) 
 
@@ -114,6 +115,13 @@ stages:
           versionSpec: $(pv)
           architecture: 'x64'
 
+      - script: 'python -m pip install uv'
+        displayName: 'Install uv'
+
+      # Resolve upgrades before Cache@2 hashes uv.lock so its save key stays stable.
+      - script: 'uv lock --upgrade --python "$(pv)" --no-cache'
+        displayName: 'Resolve latest dependencies'
+
       # Cache downloads without reusing the job environment.
       - task: Cache@2
         displayName: 'Cache uv'
@@ -124,10 +132,7 @@ stages:
             "uv" | "$(Agent.OS)"
           path: $(Pipeline.Workspace)/.uv-cache
 
-      - script: 'python -m pip install uv'
-        displayName: 'Install uv'
-
-      - script: 'uv sync --upgrade --python "$(pv)" --no-dev --group test --group e2e'
+      - script: 'uv sync --locked --python "$(pv)" --no-dev --group test --group e2e'
         displayName: 'Sync E2E environment'
         env:
           UV_CACHE_DIR: $(Pipeline.Workspace)/.uv-cache
@@ -165,6 +170,13 @@ stages:
           versionSpec: $(pv)
           architecture: 'x64'
 
+      - script: 'python -m pip install uv'
+        displayName: 'Install uv'
+
+      # Resolve upgrades before Cache@2 hashes uv.lock so its save key stays stable.
+      - script: 'uv lock --upgrade --python "$(pv)" --no-cache'
+        displayName: 'Resolve latest dependencies'
+
       # Cache downloads without reusing the job environment.
       - task: Cache@2
         displayName: 'Cache uv'
@@ -175,10 +187,7 @@ stages:
             "uv" | "$(Agent.OS)"
           path: $(Pipeline.Workspace)/.uv-cache
 
-      - script: 'python -m pip install uv'
-        displayName: 'Install uv'
-
-      - script: 'uv sync --upgrade --python "$(pv)" --no-dev --group test --group e2e'
+      - script: 'uv sync --locked --python "$(pv)" --no-dev --group test --group e2e'
         displayName: 'Sync E2E environment'
         env:
           UV_CACHE_DIR: $(Pipeline.Workspace)/.uv-cache
diff --git a/vsts/python-nightly.yaml b/vsts/python-nightly.yaml
index 870ef8ef8..662a4fba6 100644
--- a/vsts/python-nightly.yaml
+++ b/vsts/python-nightly.yaml
@@ -165,6 +165,14 @@ stages:
           versionSpec: $(pv)
           architecture: 'x64'
           addToPath: true
+
+      - script: 'python -m pip install uv'
+        displayName: 'Install uv'
+
+      # Resolve upgrades before Cache@2 hashes uv.lock so its save key stays stable.
+      - script: 'uv lock --upgrade --python "$(pv)" --no-cache'
+        displayName: 'Resolve latest dependencies'
+
       # Cache downloads without reusing the job environment.
       - task: Cache@2
         displayName: 'Cache uv'
@@ -174,10 +182,8 @@ stages:
             "uv" | "$(Agent.OS)" | "$(pv)"
             "uv" | "$(Agent.OS)"
           path: $(Pipeline.Workspace)/.uv-cache
-      - script: 'python -m pip install uv'
-        displayName: 'Install uv'
 
-      - script: 'uv sync --upgrade --python "$(pv)" --no-dev --group test --group e2e'
+      - script: 'uv sync --locked --python "$(pv)" --no-dev --group test --group e2e'
         displayName: 'Sync E2E environment'
         env:
           UV_CACHE_DIR: $(Pipeline.Workspace)/.uv-cache