diff --git a/taskcluster/docker/periodic-updates/Dockerfile b/taskcluster/docker/periodic-updates/Dockerfile
index 2cd3d81047c3..2d8ca8549eb9 100644
--- a/taskcluster/docker/periodic-updates/Dockerfile
+++ b/taskcluster/docker/periodic-updates/Dockerfile
@@ -3,6 +3,10 @@ MAINTAINER Julien Cristau <jcristau@mozilla.com>
 
 VOLUME /builds/worker/checkouts
 
+COPY --from=docker.io/astral/uv:0.12.12 /uv /uvx /bin/
+
+ENV PATH ${PATH}:${HOME}/.local/bin
+
 ADD setup.sh /setup/setup.sh
 
 RUN cd /setup && ./setup.sh
diff --git a/taskcluster/docker/periodic-updates/scripts/periodic_file_updates.sh b/taskcluster/docker/periodic-updates/scripts/periodic_file_updates.sh
index da4388c05c77..88a0f001b915 100755
--- a/taskcluster/docker/periodic-updates/scripts/periodic_file_updates.sh
+++ b/taskcluster/docker/periodic-updates/scripts/periodic_file_updates.sh
@@ -498,9 +498,8 @@ function compare_remote_settings_files {
 
     # bug 1959683: remote settings update can add untracked search-config-icons
     # It is not safe to take these (see https://bugzilla.mozilla.org/show_bug.cgi?id=1873448)
-    # If they are around as untracked files when `arc diff` runs, that command will fail.
-    # (We explicitly don't want to use `arc diff --allow-untracked` to avoid accidentally
-    # missing files from other updates - we'd rather the job fail.)
+    # moz-phab submits commits rather than the working copy, so it would silently
+    # leave these behind (warning but not failing); explicitly drop them here.
     if [ "${USE_GIT}" == "true" ]; then
       ${GIT} -C "${TOPSRCDIR}" clean -f -d services/settings/dumps/main/search-config-icons
     else
@@ -646,8 +645,9 @@ function push_repo {
   then
     return 1
   fi
-  if ! ARC=$(command -v arc) && ! ARC=$(command -v arcanist)
+  if ! command -v moz-phab
   then
+    echo moz-phab not found >&2
     return 1
   fi
   if [ -z "${REVIEWERS}" ]
@@ -657,24 +657,21 @@ function push_repo {
   # Clean up older review requests of the same type as this run.
   # Pinning updates (HSTS/HPKP) and periodic updates are separate tasks and
   # must not abandon each other's patches.
-  # Turn  Needs Review D624: No bug, Automated HSTS ...
-  # into D624
-  ALL_DIFFS=$($ARC list | grep "Needs Review" | grep -E "${BRANCH} repo-update" || true)
   if [ "${DO_HSTS}" == "true" ] || [ "${DO_HPKP}" == "true" ]; then
-    OLDER_DIFFS=$(echo "${ALL_DIFFS}" | grep -E "HSTS|HPKP" || true)
+    PINNING=true
   else
-    OLDER_DIFFS=$(echo "${ALL_DIFFS}" | grep -vE "HSTS|HPKP" || true)
+    PINNING=false
   fi
-  for diff in $(echo "${OLDER_DIFFS}" | awk 'match($0, /D[0-9]+[^: ]/) { print substr($0, RSTART, RLENGTH)  }')
+  # shellcheck disable=SC2016  # $branch and $pinning are jq variables, not shell
+  for diff in $(moz-phab list --status needs-review --format json | \
+    "${JQ}" --arg branch "${BRANCH}" --argjson pinning "${PINNING}" \
+      '.[] | select(.title | test($branch + " repo-update")) | select((.title | test("HSTS|HPKP")) == $pinning) | .id')
   do
-    echo "Removing old request $diff"
-    # There is no 'arc abandon', see bug 1452082
-    echo '{"transactions": [{"type":"abandon", "value": true}], "objectIdentifier": "'"${diff}"'"}' | $ARC call-conduit -- differential.revision.edit
+    echo "Removing old request D$diff"
+    moz-phab abandon "D$diff"
   done
 
-  # bug 1959683: using /dev/null as stdin causes arcanist to fail quickly
-  # instead of hang if user input is requested.
-  $ARC diff --verbatim --reviewers "${REVIEWERS}" < /dev/null
+  moz-phab submit -s --reviewers "${REVIEWERS}" --no-bug
 }
 
 
diff --git a/taskcluster/docker/periodic-updates/setup.sh b/taskcluster/docker/periodic-updates/setup.sh
index 0e36d9538c4d..e0d1fa7160ff 100755
--- a/taskcluster/docker/periodic-updates/setup.sh
+++ b/taskcluster/docker/periodic-updates/setup.sh
@@ -15,16 +15,24 @@ apt-get install -y --no-install-recommends \
     libxml2-utils \
     libxt6 \
     libxtst6 \
-    php-cli \
-    php-curl \
     shellcheck \
     unzip \
     bzip2 \
     wget
 
-# Install specific version of Arcanist to avoid PHP deprecation issues (Bug 2016414)
-git clone https://github.com/phacility/arcanist.git /usr/local/share/arcanist
-git -C /usr/local/share/arcanist checkout e50d1bc4eabac9c37e3220e9f3fb8e37ae20b957
-ln -s /usr/local/share/arcanist/bin/arc /usr/local/bin/arc
+uv tool install MozPhab==2.19.0
+
+# turn off update checks
+cat >"$HOME"/.moz-phab-config<<EOF
+[updater]
+self_last_check = -1
+self_auto_update = False
+EOF
+
+# moz-phab requires some hg config even though it's not used
+cat >"$HOME"/.hgrc<<EOF
+[ui]
+username = hg user <user@example.com>
+EOF
 
 rm -rf /setup