diff --git a/.github/workflows/reusable_prerelease.yml b/.github/workflows/reusable_prerelease.yml
index 9c3d701..21a053c 100644
--- a/.github/workflows/reusable_prerelease.yml
+++ b/.github/workflows/reusable_prerelease.yml
@@ -26,6 +26,11 @@ jobs:
       - name: Build
         run: |
           pip install --upgrade hatch "click<8.3" "virtualenv<21"
+          # Keep hatchling 1.32.1 out of the isolated build env (pypa/hatch#2427).
+          # See reusable_python_build.yml for why the pin must be a constraint.
+          echo 'hatchling!=1.32.1' > "$RUNNER_TEMP/build-constraints.txt"
+          export UV_CONSTRAINT="$RUNNER_TEMP/build-constraints.txt"
+          export PIP_CONSTRAINT="$RUNNER_TEMP/build-constraints.txt"
           hatch -v build
 
       - name: UploadArtifacts
diff --git a/.github/workflows/reusable_publish.yml b/.github/workflows/reusable_publish.yml
index cb5244f..3a1cb34 100644
--- a/.github/workflows/reusable_publish.yml
+++ b/.github/workflows/reusable_publish.yml
@@ -79,6 +79,11 @@ jobs:
       - name: Build
         run: |
           pip install --upgrade hatch "click<8.3" "virtualenv<21"
+          # Keep hatchling 1.32.1 out of the isolated build env (pypa/hatch#2427).
+          # See reusable_python_build.yml for why the pin must be a constraint.
+          echo 'hatchling!=1.32.1' > "$RUNNER_TEMP/build-constraints.txt"
+          export UV_CONSTRAINT="$RUNNER_TEMP/build-constraints.txt"
+          export PIP_CONSTRAINT="$RUNNER_TEMP/build-constraints.txt"
           hatch -v build
 
       - name: Configure AWS credentials
@@ -168,6 +173,13 @@ jobs:
         run: |
           pip install --upgrade hatch "click<8.3" "virtualenv<21"
           pip install --upgrade twine
+          # Keep hatchling 1.32.1 out of the isolated build env (pypa/hatch#2427).
+          # See reusable_python_build.yml for why the pin must be a constraint.
+          echo 'hatchling!=1.32.1' > "$RUNNER_TEMP/build-constraints.txt"
+          {
+            echo "UV_CONSTRAINT=$RUNNER_TEMP/build-constraints.txt"
+            echo "PIP_CONSTRAINT=$RUNNER_TEMP/build-constraints.txt"
+          } >> "$GITHUB_ENV"
 
       - name: Build
         run: hatch -v build
diff --git a/.github/workflows/reusable_python_build.yml b/.github/workflows/reusable_python_build.yml
index c8cfa79..6902a2d 100644
--- a/.github/workflows/reusable_python_build.yml
+++ b/.github/workflows/reusable_python_build.yml
@@ -53,6 +53,9 @@ jobs:
         python-version: ${{ inputs.python-version }}
 
     - name: Install Hatch
+      # bash on every OS: the constraint snippet below uses POSIX redirection,
+      # and this job also runs on windows-latest where the default is pwsh.
+      shell: bash
       run: |
         # pyproject-hooks 1.3.0 renamed the env var carrying an in-tree
         # backend's backend-path to _PYPROJECT_HOOKS_BACKEND_PATH_JSON
@@ -62,6 +65,18 @@ jobs:
         # once hatch sets the new name.
         pip install --upgrade hatch "click<8.3" "virtualenv<21" "pyproject-hooks<1.3"
 
+        # hatchling 1.32.1 imports `hatch`, which is absent from the isolated
+        # build env that `hatch build` creates, so every build fails with
+        # ModuleNotFoundError (pypa/hatch#2427; the release is yanked). A pin
+        # on the line above only reaches the CLI env. The build env is
+        # installed by uv and honours UV_CONSTRAINT; PIP_CONSTRAINT covers a
+        # pip-installed one.
+        echo 'hatchling!=1.32.1' > "$RUNNER_TEMP/build-constraints.txt"
+        {
+          echo "UV_CONSTRAINT=$RUNNER_TEMP/build-constraints.txt"
+          echo "PIP_CONSTRAINT=$RUNNER_TEMP/build-constraints.txt"
+        } >> "$GITHUB_ENV"
+
     - name: Run Linting
       run: hatch -v run lint