diff --git a/.python-version b/.python-version
new file mode 100644
index 0000000..e4fba21
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.12
diff --git a/README.md b/README.md
index f0bb56b..6e76e46 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,18 @@ create-python-app/          # virtual workspace root (no [project] table)
 uv sync
 ```
 
+
+## Python version
+
+- **Pin file:** `.python-version` → `3.12`
+- **Constraint:** every workspace member sets `requires-python = ">=3.12"`
+- **CI:** workflows (Epic 6 / #45) must install Python 3.12+ matching this pin
+
+```bash
+uv python install  # respects .python-version when needed
+uv sync
+```
+
 ### Reference
 
 - [uv workspaces handbook](https://pydevtools.com/handbook/how-to/how-to-set-up-a-python-monorepo-with-uv-workspaces/)
diff --git a/pyproject.toml b/pyproject.toml
index 9687bf6..1650210 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,12 @@
 # Virtual workspace root — not a publishable package.
 # See: https://pydevtools.com/handbook/how-to/how-to-set-up-a-python-monorepo-with-uv-workspaces/
+#
+# Python pin: .python-version + requires-python on every member (>=3.12).
+# CI must use the same minor (document when workflows land — Epic 6).
 
 [tool.uv.workspace]
 members = ["packages/*"]
+
+[tool.uv]
+# Prefer the pinned interpreter from .python-version when creating the venv.
+python-preference = "managed"