diff --git a/.github/scripts/envgen.py b/.github/scripts/envgen.py
index f4cfdc5..37cd41d 100644
--- a/.github/scripts/envgen.py
+++ b/.github/scripts/envgen.py
@@ -156,15 +156,17 @@ def _filtered(pkgs, env_name=None):
 def dbconnect_pin(pkgs):
     """Return the dev-group databricks-connect requirement, or None.
 
-    Serverless lists a concrete databricks-connect (e.g. '17.3.1'), but a serverless
-    environment version tracks a whole major line, not a single point release. So the
-    pin is by bare major — ``~=MAJOR.0`` (e.g. '17.3.1' -> ``databricks-connect~=17.0``,
-    resolving ``>=17.0, <18.0``) — to pick up the latest release within that major.
+    Serverless lists a concrete databricks-connect (e.g. '18.0.9'). The pin is by
+    MAJOR.MINOR — ``~=MAJOR.MINOR.0`` (e.g. '18.0.9' -> ``databricks-connect~=18.0.0``,
+    resolving ``>=18.0.0, <18.1``) — matching the minor series the constraint list was
+    generated from. A broader major-only pin (``~=18.0``) allows newer minor releases
+    whose bundled pyspark protobuf stubs may be incompatible with the pinned runtime
+    libraries (protobuf, grpcio) in the constraint list.
     """
     v = pkgs.get("databricks-connect")
     if not v:
         return None
-    return f"databricks-connect~={v.split('.')[0]}.0"
+    return f"databricks-connect~={'.'.join(v.split('.')[:2])}.0"
 
 
 def build_pyproject(pkgs, env_name, python_version, dbconnect=None):
diff --git a/.github/scripts/test_envgen.py b/.github/scripts/test_envgen.py
index 4eaf8e6..4ba2fa1 100644
--- a/.github/scripts/test_envgen.py
+++ b/.github/scripts/test_envgen.py
@@ -132,12 +132,12 @@ def test_constraints(self):
 class DbconnectPinTest(unittest.TestCase):
     def test_strips_local_version_segment(self):
         # databricks-connect is installed from the dev group as a plain PyPI release;
-        # the pin is normalized to ~=MAJOR.0, so a local segment in the release-notes
+        # the pin is normalized to ~=MAJOR.MINOR.0, so a local segment in the release-notes
         # version is discarded and never lands in an artifact. dbconnect_pin reads raw
         # pkgs (not _filtered), so this guards that the normalization does the stripping.
         self.assertEqual(
             dbconnect_pin({"databricks-connect": "17.3.1+db1"}),
-            "databricks-connect~=17.0",
+            "databricks-connect~=17.3.0",
         )
 
     def test_none_when_absent(self):
diff --git a/python/serverless/serverless-v1/pyproject.toml b/python/serverless/serverless-v1/pyproject.toml
index 601f54d..f26c2d2 100644
--- a/python/serverless/serverless-v1/pyproject.toml
+++ b/python/serverless/serverless-v1/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.10.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=14.0",
+    "databricks-connect~=14.3.0",
 ]
 
 [tool.uv]
diff --git a/python/serverless/serverless-v2/pyproject.toml b/python/serverless/serverless-v2/pyproject.toml
index 497624e..bd154dc 100644
--- a/python/serverless/serverless-v2/pyproject.toml
+++ b/python/serverless/serverless-v2/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.11.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=15.0",
+    "databricks-connect~=15.4.0",
 ]
 
 [tool.uv]
diff --git a/python/serverless/serverless-v3/pyproject.toml b/python/serverless/serverless-v3/pyproject.toml
index 89c4b0c..dde7b22 100644
--- a/python/serverless/serverless-v3/pyproject.toml
+++ b/python/serverless/serverless-v3/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.12.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=16.0",
+    "databricks-connect~=16.4.0",
 ]
 
 [tool.uv]
diff --git a/python/serverless/serverless-v4/pyproject.toml b/python/serverless/serverless-v4/pyproject.toml
index 7440c67..1f3f040 100644
--- a/python/serverless/serverless-v4/pyproject.toml
+++ b/python/serverless/serverless-v4/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.12.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=17.0",
+    "databricks-connect~=17.3.0",
 ]
 
 [tool.uv]
diff --git a/python/serverless/serverless-v5-ml/pyproject.toml b/python/serverless/serverless-v5-ml/pyproject.toml
index 9861787..9a1ef8c 100644
--- a/python/serverless/serverless-v5-ml/pyproject.toml
+++ b/python/serverless/serverless-v5-ml/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.12.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=18.0",
+    "databricks-connect~=18.0.0",
 ]
 
 [tool.uv]
diff --git a/python/serverless/serverless-v5/pyproject.toml b/python/serverless/serverless-v5/pyproject.toml
index e344eb3..53f1496 100644
--- a/python/serverless/serverless-v5/pyproject.toml
+++ b/python/serverless/serverless-v5/pyproject.toml
@@ -7,7 +7,7 @@ requires-python = "==3.12.*"
 
 [dependency-groups]
 dev = [
-    "databricks-connect~=18.0",
+    "databricks-connect~=18.0.0",
 ]
 
 [tool.uv]