diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 792fb3f..c8c4019 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -57,7 +57,8 @@ jobs:
       - name: Build Package
         if: success()
         run: |
-          uv build
+          scripts/export_build_constraints.sh /tmp/build-constraints.txt
+          uv build -b /tmp/build-constraints.txt
 
       - name: Export requirements.txt
         run: |
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index e9bdaec..96d6e03 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -39,6 +39,7 @@ jobs:
         run: |
           . /opt/ros/humble/setup.sh && \
           uv sync --all-extras --dev --all-packages && \
-          uv build --all-packages
+          scripts/export_build_constraints.sh /tmp/build-constraints.txt && \
+          uv build --all-packages -b /tmp/build-constraints.txt
       - run: |
           . /opt/ros/humble/setup.sh && uv run mkdocs gh-deploy --strict --force
\ No newline at end of file
diff --git a/README.md b/README.md
index db365fb..044da5c 100644
--- a/README.md
+++ b/README.md
@@ -64,9 +64,19 @@ This method builds Python packages (wheel files) that can be installed using `uv
 git clone --recursive https://github.com/tier4/sync_tooling.git
 cd sync_tooling
 
-uv build --all-packages
+scripts/export_build_constraints.sh /tmp/build-constraints.txt
+uv build --all-packages -b /tmp/build-constraints.txt
 ```
 
+`export_build_constraints.sh` writes pinned protobuf codegen dependency versions from
+`uv.lock` so isolated `uv build` does not re-resolve newer Hatch hook dependencies.
+
+During development, `uv sync` also runs protobuf codegen for `sync-tooling-msgs` (Hatch hook).
+Workspace `[tool.uv] build-constraint-dependencies` in `pyproject.toml` keeps that codegen aligned
+with the locked runtime `protobuf` version. When bumping `protobuf` or related packages in
+`uv.lock`, update `build-constraint-dependencies` to the same pins (or run
+`scripts/export_build_constraints.sh` and copy the versions).
+
 This will generate a `dist` directory with the built packages, and the `dist/*.whl` files can be
 installed using `pip`:
 
diff --git a/pyproject.toml b/pyproject.toml
index c89e66b..996ed16 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,6 +30,13 @@ diag-worker = "diag_worker.main:main"
 
 [tool.uv]
 python-preference = "only-system"
+# Pin codegen deps during `uv sync` workspace builds (see scripts/export_build_constraints.sh).
+build-constraint-dependencies = [
+  "protobuf==6.33.4",
+  "mypy-protobuf==5.0.0",
+  "hatch-protobuf==0.5.0",
+  "types-protobuf==6.32.1.20251210",
+]
 
 [tool.uv.sources]
 journal_monitor = { workspace = true }
diff --git a/scripts/cloudflare_pages_build.sh b/scripts/cloudflare_pages_build.sh
index 9b69127..48c27f2 100755
--- a/scripts/cloudflare_pages_build.sh
+++ b/scripts/cloudflare_pages_build.sh
@@ -23,5 +23,6 @@ dpkg --fsys-tarfile libgvc6*.deb |  tar -xf - -C graphviz/
 graphviz_dir="$(realpath graphviz)"
 export PATH="$PATH:$graphviz_dir/usr/bin"
 uv sync --all-packages --all-extras
-uv build --all-packages
+scripts/export_build_constraints.sh /tmp/build-constraints.txt
+uv build --all-packages -b /tmp/build-constraints.txt
 uv run mkdocs build --strict
\ No newline at end of file
diff --git a/scripts/export_build_constraints.sh b/scripts/export_build_constraints.sh
new file mode 100755
index 0000000..86bee16
--- /dev/null
+++ b/scripts/export_build_constraints.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Copyright 2025 TIER IV, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+if [[ $# -lt 1 ]]; then
+  echo "Usage: $0 <output-path>" >&2
+  exit 1
+fi
+
+out="$1"
+pattern='^(protobuf|mypy-protobuf|hatch-protobuf|types-protobuf)=='
+
+strip_constraints() {
+  grep -E "$pattern" | sed -E 's/\s*\\?\s*$//' | awk '{print $1}'
+}
+
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+
+uv export --frozen --package sync-tooling-msgs --only-group dev 2>/dev/null | strip_constraints >"$tmp"
+
+if ! grep -q '^types-protobuf==' "$tmp"; then
+  uv export --frozen --package sync-tooling-msgs 2>/dev/null | strip_constraints >>"$tmp"
+fi
+
+sort -u "$tmp" >"$out"
+
+# Keep [tool.uv] build-constraint-dependencies in pyproject.toml aligned with this output.
diff --git a/uv.lock b/uv.lock
index aa647d3..acbf5cf 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 2
+revision = 3
 requires-python = ">=3.10"
 resolution-markers = [
     "python_full_version >= '3.14' and sys_platform == 'win32'",
@@ -26,6 +26,12 @@ members = [
     "sync-tooling",
     "sync-tooling-msgs",
 ]
+build-constraints = [
+    { name = "hatch-protobuf", specifier = "==0.5.0" },
+    { name = "mypy-protobuf", specifier = "==5.0.0" },
+    { name = "protobuf", specifier = "==6.33.4" },
+    { name = "types-protobuf", specifier = "==6.32.1.20251210" },
+]
 
 [[package]]
 name = "aiostream"