diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 0ea35c4..49ee2c4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -2,6 +2,11 @@ name: Docs
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
+env:
+  FORCE_COLOR: 1
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -15,13 +20,10 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-          cache: pip
-          cache-dependency-path: tox.ini
 
-      - name: Install dependencies
-        run: |
-          python -m pip install -U pip
-          python -m pip install -U tox
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
 
       - name: Docs
-        run: tox -e docs
+        run: |
+          uvx --with tox-uv tox -e docs
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d48e404..7b9053a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2,8 +2,11 @@ name: Lint
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 env:
   FORCE_COLOR: 1
+  RUFF_OUTPUT_FORMAT: github
 
 jobs:
   lint:
@@ -29,6 +32,6 @@ jobs:
         with:
           python-version: "3.x"
       - name: Install uv
-        uses: hynek/setup-cached-uv@v2
+        uses: astral-sh/setup-uv@v5
       - name: Mypy
         run: uvx --with tox-uv tox -e mypy
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5b5071d..33a22fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,8 @@ on:
       - published
   workflow_dispatch:
 
+permissions: {}
+
 env:
   FORCE_COLOR: 1
 
@@ -59,7 +61,6 @@ jobs:
       - name: Upload package to Test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          attestations: true
           repository-url: https://test.pypi.org/legacy/
 
   # Upload to real PyPI on GitHub Releases.
@@ -83,5 +84,3 @@ jobs:
 
       - name: Upload package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          attestations: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d44a6e8..aaf45ac 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,6 +2,8 @@ name: Test
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 env:
   FORCE_COLOR: 1
 
@@ -36,7 +38,7 @@ jobs:
           brew install gettext
 
       - name: Install uv
-        uses: hynek/setup-cached-uv@v2
+        uses: astral-sh/setup-uv@v5
 
       - name: Generate translation binaries
         run: |
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5c7906b..c358c76 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,12 +1,12 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.6
+    rev: v0.9.6
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.10.0
+    rev: 25.1.0
     hooks:
       - id: black
 
@@ -26,18 +26,18 @@ repos:
         exclude: \.github/ISSUE_TEMPLATE\.md|\.github/PULL_REQUEST_TEMPLATE\.md
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.30.0
+    rev: 0.31.1
     hooks:
       - id: check-github-workflows
       - id: check-renovate
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.6
+    rev: v1.7.7
     hooks:
       - id: actionlint
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.0.0
+    rev: v1.3.1
     hooks:
       - id: zizmor
 
@@ -52,12 +52,12 @@ repos:
       - id: validate-pyproject
 
   - repo: https://github.com/tox-dev/tox-ini-fmt
-    rev: 1.4.1
+    rev: 1.5.0
     hooks:
       - id: tox-ini-fmt
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.4.2
+    rev: v3.5.0
     hooks:
       - id: prettier
         args: [--prose-wrap=always, --print-width=88]