diff --git a/.github/workflows/open-sync-pr.yml b/.github/workflows/open-sync-pr.yml
index ed1c344..717cc97 100644
--- a/.github/workflows/open-sync-pr.yml
+++ b/.github/workflows/open-sync-pr.yml
@@ -12,6 +12,10 @@ permissions:
   contents: read
   pull-requests: write
 
+concurrency:
+  group: open-sync-pr
+  cancel-in-progress: false
+
 jobs:
   open-pr:
     runs-on: ubuntu-latest
@@ -22,7 +26,9 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          OPEN=$(gh pr list --head sync/main --base main --state open --json number --jq length)
+          OPEN=$(gh api -X GET repos/ClickHouse/code-interpreter/pulls \
+            -f state=open -f base=main -f head=ClickHouse:sync/main \
+            -f per_page=1 --jq length)
           if [ "$OPEN" -gt 0 ]; then
             echo "Sync PR already open."
             exit 0
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 0fedca8..441ba55 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,20 +5,20 @@ Thanks for your interest in Code Interpreter!
 ## How this repository is maintained
 
 This repository is published from an internal ClickHouse monorepo, which is
-the source of truth. Every change that lands internally is mirrored here as a
-snapshot commit on the `sync/main` branch (spot them by the
-`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting
-sync pull request to release it to `main`.
+the source of truth. Internal changes that are not already public are mirrored
+here as a snapshot commit on the `sync/main` branch (spot them by the
+`Source: ClickHouse/ai@<sha>` trailer); a maintainer merges the resulting sync
+pull request to release it to `main`.
 
 Practical consequences:
 
-- **Pull requests are welcome.** CI runs on every PR. A maintainer reviews
-  your change, imports it into the internal repository, and it arrives back
-  with the next sync PR. We preserve attribution with a `Co-authored-by:`
-  trailer — your PR will be closed with a reference to the sync that
-  contains it.
-- **`main` accepts no direct pushes.** It only advances by merging sync pull
-  requests; branch rules enforce this with no exceptions.
+- **Pull requests are welcome.** CI runs on every PR. After a maintainer merges
+  your change here, an automated bridge opens a matching internal pull request
+  from the exact landed range. The internal review and CI gates still apply,
+  and attribution is preserved with a `Co-authored-by:` trailer.
+- **`main` accepts no direct pushes.** It advances through reviewed community
+  pull requests and automated sync pull requests; branch rules enforce this
+  with no exceptions.
 - **History is snapshot-based.** Commits here intentionally do not mirror the
   internal commit history.
 
diff --git a/docker/package-init.sh b/docker/package-init.sh
index c4e3cab..0f50888 100644
--- a/docker/package-init.sh
+++ b/docker/package-init.sh
@@ -13,6 +13,13 @@ FORCE_REBUILD="${FORCE_REBUILD:-false}"
 PYTHON_VERSION="${PYTHON_VERSION:-3.14.4}"
 PYTHON_SITE_VERSION="${PYTHON_VERSION%.*}"
 PYTHON_ALIAS="python${PYTHON_SITE_VERSION}"
+# "uv" (default) installs the Python package list noticeably faster than pip.
+# Set to "pip" to use the previous behavior. Like any unpinned "latest
+# compatible" install, the exact resolved versions can differ run to run (and
+# between installers) for packages with no version constraint in the list
+# below — that's inherent to installing unpinned packages, not specific to uv.
+PYTHON_PACKAGE_INSTALLER="${PYTHON_PACKAGE_INSTALLER:-uv}"
+UV_VERSION="${UV_VERSION:-0.11.26}"
 NODE_VERSION="${NODE_VERSION:-24.15.0}"
 BUN_VERSION="${BUN_VERSION:-1.3.14}"
 BASH_PACKAGE_VERSION="${BASH_PACKAGE_VERSION:-5.2.0}"
@@ -167,10 +174,16 @@ if [ -f "$PIP_PATH" ]; then
     "$PIP_PATH" install --upgrade pip 2>/dev/null || true
     PYTHON_PACKAGES_INSTALLED=false
 
+    PYTHON_INSTALL_CMD=("$PIP_PATH" install)
+    if [ "$PYTHON_PACKAGE_INSTALLER" = "uv" ]; then
+        "$PIP_PATH" install "uv==${UV_VERSION}" 2>/dev/null || true
+        PYTHON_INSTALL_CMD=("${PKG_DEST}/bin/uv" pip install --python "${PKG_DEST}/bin/python3")
+    fi
+
     # MarkItDown 0.1.x initializes Magika/ONNX at import time; the aarch64
     # onnxruntime wheel segfaults under NsJail. 0.0.2 still supports PPTX via
     # python-pptx without that native dependency.
-    if ! "$PIP_PATH" install \
+    if ! "${PYTHON_INSTALL_CMD[@]}" \
         openpyxl \
         matplotlib \
         numpy \