diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6993aed..12331bd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,7 +5,7 @@ updates:
   directory: /
   schedule:
     interval: monthly
-  groups:
-    github-actions:
-      patterns:
-      - '*'
+- package-ecosystem: cargo
+  directory: /
+  schedule:
+    interval: monthly
diff --git a/.github/workflows/dists.yml b/.github/workflows/dists.yml
index 1bc2c0a..18955d1 100644
--- a/.github/workflows/dists.yml
+++ b/.github/workflows/dists.yml
@@ -3,7 +3,7 @@ name: dists
 on:
   pull_request:
   push:
-    branches: '**'  # not tags
+    branches: [master]
   release:
     types: [released, prereleased]
   workflow_dispatch:  # allows running workflow manually from the Actions tab
@@ -14,58 +14,82 @@ concurrency:  # https://stackoverflow.com/questions/66335225#comment133398800_72
 
 jobs:
   wheel:
-    name: ${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'auto' }}
+    name: ${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux }}
     strategy:
       fail-fast: false
       matrix:
         include:
-        - { os: macos-latest,   target: x86_64 }
-        - { os: macos-latest,   target: aarch64 }
-        - { os: ubuntu-latest,  target: x86_64 }
-        - { os: ubuntu-latest,  target: aarch64 }
-        - { os: ubuntu-latest,  target: i686 }
-        - { os: ubuntu-latest,  target: armv7 }
-        - { os: ubuntu-latest,  target: ppc64le }
-        - { os: ubuntu-latest,  target: s390x }
-        - { os: ubuntu-latest,  target: x86_64,  manylinux: musllinux_1_1 }
-        - { os: ubuntu-latest,  target: aarch64, manylinux: musllinux_1_1 }
-        - { os: windows-latest, target: x86_64 }
-        - { os: windows-latest, target: i686 }
+        - { os: macos-15,     target: x86_64,  manylinux: auto}
+        - { os: macos-15,     target: aarch64, manylinux: auto}
+        - { os: ubuntu-24.04, target: x86_64,  manylinux: auto}
+        - { os: ubuntu-24.04, target: aarch64, manylinux: auto}
+        - { os: ubuntu-24.04, target: i686,    manylinux: auto}
+        - { os: ubuntu-24.04, target: armv7,   manylinux: auto}
+        - { os: ubuntu-24.04, target: ppc64le, manylinux: auto}
+        - { os: ubuntu-24.04, target: s390x,   manylinux: auto}
+        - { os: ubuntu-24.04, target: x86_64,  manylinux: musllinux_1_1 }
+        - { os: ubuntu-24.04, target: aarch64, manylinux: musllinux_1_1 }
+        - { os: windows-2025, target: x86_64,  manylinux: auto}
+        - { os: windows-2025, target: i686,    manylinux: auto}
 
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v4
 
+    # keep python versions in sync with tests.yml
+    # all python versions need to be present for linking to succeed
     - uses: actions/setup-python@v5
       with:
-        # pin to the latest supported python version
-        python-version: "3.13"
-        # x86 python needs to be available for the win32 wheel
-        architecture: ${{ ( matrix.os == 'windows-latest' && matrix.target == 'i686' ) && 'x86' || null }}
+        python-version: '3.8'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.9'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.10'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.13'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
+    - uses: Quansight-Labs/setup-python@v5 # 3.13t support not yet merged ref https://github.com/actions/setup-python/pull/973#issuecomment-2495900996
+      with:
+        python-version: '3.13t'
+        architecture: ${{ ( startsWith(matrix.os, 'windows') && matrix.target == 'i686' ) && 'x86' || null }}
 
-    - uses: PyO3/maturin-action@v1
+    - uses: PyO3/maturin-action@v1.45.0
       with:
         target: ${{ matrix.target }}
-        manylinux: ${{ matrix.manylinux || 'auto' }}
-        # Keep in sync with tests.yml
+        manylinux: ${{ matrix.manylinux }}
+        # keep python versions in sync with tests.yml
         args: --release --out dist --interpreter '3.8 3.9 3.10 3.11 3.12 3.13 3.13t'
         rust-toolchain: stable
         docker-options: -e CI
 
-    - run: ${{ (matrix.os == 'windows-latest' && 'dir') || 'ls -ltra' }} dist/
+    - run: ${{ (startsWith(matrix.os, 'windows') && 'dir') || 'ls -ltra' }} dist/
 
     - uses: actions/upload-artifact@v4
       with:
-        name: dist-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'auto' }}
+        name: dist-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux }}
         path: dist
 
   sdist:
     name: sdist
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v4
 
-    - uses: PyO3/maturin-action@v1
+    - uses: PyO3/maturin-action@v1.45.0
       with:
         command: sdist
         args: --out dist
@@ -79,7 +103,7 @@ jobs:
   publish:
     if: github.event_name == 'release'
     needs: [wheel, sdist]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     permissions:
       contents: write  # softprops/action-gh-release
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 65679b7..95ce0aa 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -3,7 +3,7 @@ name: tests
 on:
   pull_request:
   push:
-    branches: '**'  # not tags
+    branches: [master]
   workflow_dispatch:  # allows running workflow manually from the Actions tab
 
 concurrency:  # https://stackoverflow.com/questions/66335225#comment133398800_72408109
diff --git a/Cargo.toml b/Cargo.toml
index 66869cb..7e4dd43 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,7 +21,7 @@ crate-type = ["cdylib"]
 neon = ["blake3/neon"]
 
 [dependencies]
-blake3 = { version = "1.5", features = ["mmap", "rayon"] }
-hex = "0.4.2"
-pyo3 = { version = "0.23.3", features = ["extension-module", "generate-import-lib"] }
-rayon = "1.2.1"
+blake3 = { version = "1.5.5", features = ["mmap", "rayon"] }
+hex = "0.4.3"
+pyo3 = { version = "0.23.3", features = ["extension-module"] }
+rayon = "1.10.0"
diff --git a/README.md b/README.md
index 12cf78c..cc337e2 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# blake3-py [![Actions Status](https://github.com/oconnor663/blake3-py/workflows/tests/badge.svg)](https://github.com/oconnor663/blake3-py/actions) [![PyPI version](https://badge.fury.io/py/blake3.svg)](https://pypi.python.org/pypi/blake3)
+# blake3-py [![tests](https://github.com/oconnor663/blake3-py/actions/workflows/tests.yml/badge.svg?branch=master&event=push)](https://github.com/oconnor663/blake3-py/actions/workflows/tests.yml) [![PyPI version](https://badge.fury.io/py/blake3.svg)](https://pypi.python.org/pypi/blake3)
 
 Python bindings for the [official Rust implementation of
 BLAKE3](https://github.com/BLAKE3-team/BLAKE3), based on