diff --git a/changelog.d/+windows-lock-reader.bugfix.md b/changelog.d/+windows-lock-reader.bugfix.md
new file mode 100644
index 0000000..626cf30
--- /dev/null
+++ b/changelog.d/+windows-lock-reader.bugfix.md
@@ -0,0 +1,2 @@
+`install-locked-tools` installs the lock reader on Windows again: it ran the installer from the lock reader's own
+interpreter, and Windows refused to replace that running `python.exe` when the installer recreated the environment.
diff --git a/install-locked-tools/action.yml b/install-locked-tools/action.yml
index fb7bc7f..0f7738a 100644
--- a/install-locked-tools/action.yml
+++ b/install-locked-tools/action.yml
@@ -37,8 +37,9 @@ runs:
       env:
         EXCLUDE_NEWER: ${{ inputs.exclude-newer }}
         EXCLUDE_NEWER_PACKAGE: ${{ inputs.exclude-newer-package }}
+      # The script recreates lock-reader, and Windows refuses to replace the python.exe it would be running from.
       run: >-
-        uv run --no-project --python "$RUNNER_TEMP/lock-reader" python "$GITHUB_ACTION_PATH/../tools/install_live_tools.py" "$RUNNER_TEMP/lock-reader" --only-binary :all: 'certifi>=2026.7.22' 'packaging>=26.3'
+        uv run --no-project --python 3.15 python "$GITHUB_ACTION_PATH/../tools/install_live_tools.py" "$RUNNER_TEMP/lock-reader" --only-binary :all: 'certifi>=2026.7.22' 'packaging>=26.3'
     - id: selection
       name: ⚙️ Select locked groups and build constraints
       shell: bash