I had a pretty fun time with it myself. Rather than a system package for pip, or the `ensurepip`-provided one, I've been using the copy managed by pipx. I had to:

* Update system certificates

* Locate that pip and directly invoke it to self-update with hash pinning, rather than going through pipx

* Fix a few stray venvs that contained their own pip

* Use the fixed pipx to update uv (although I guess the uv self-update should work even for a pipx-installed copy?)

The legacy-certs hint is neat. I did it the first way but would rather not have since I'm on Mint.