diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index beb9625..4d79dd3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,8 @@ on:
 
 name: release
 
+permissions: {}
+
 jobs:
   pypi:
     name: upload release to PyPI
@@ -25,7 +27,7 @@ jobs:
 
     - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
-        python-version: "3.x"
+        python-version-file: pyproject.toml
 
     - name: deps
       run: python -m pip install -U build
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ae0bb1e..59ae8ab 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -8,6 +8,8 @@ on:
     branches: ["master"]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   tests:
     name: "Python ${{ matrix.python-version }} ${{ matrix.os }}"
@@ -16,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
         os: ["macos-latest", "windows-latest", "ubuntu-latest"]
 
     steps:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 662d49f..3880ad1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions: {}
+
 jobs:
   zizmor:
     name: zizmor latest via PyPI
diff --git a/cachecontrol/__init__.py b/cachecontrol/__init__.py
index 5493afa..62e00b1 100644
--- a/cachecontrol/__init__.py
+++ b/cachecontrol/__init__.py
@@ -9,7 +9,7 @@
 
 __author__ = "Eric Larson"
 __email__ = "eric@ionrock.org"
-__version__ = "0.14.2"
+__version__ = "0.14.3"
 
 from cachecontrol.adapter import CacheControlAdapter
 from cachecontrol.controller import CacheController
diff --git a/docs/release_notes.rst b/docs/release_notes.rst
index 3b63b5e..155dd1c 100644
--- a/docs/release_notes.rst
+++ b/docs/release_notes.rst
@@ -7,6 +7,11 @@
  Release Notes
 ===============
 
+0.14.3
+======
+
+* Drop support for Python 3.8.
+
 0.14.2
 ======
 
@@ -16,7 +21,6 @@
 0.14.1
 ======
 
-* Drop support for Python 3.8.
 * Explicitly support Python 3.13.
 
 0.14.0
diff --git a/pyproject.toml b/pyproject.toml
index 6b1b866..d8890eb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -24,7 +24,6 @@ classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Web Environment",
     "Operating System :: OS Independent",
-    "Programming Language :: Python :: 3.8",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
@@ -34,7 +33,7 @@ classifiers = [
 ]
 keywords = ["requests", "http", "caching", "web"]
 dependencies = ["requests >= 2.16.0", "msgpack >= 0.5.2, < 2.0.0"]
-requires-python = ">=3.8"
+requires-python = ">=3.9"
 
 [project.urls]
 Homepage = "https://pypi.org/project/CacheControl/"