diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 4c6c6e1..350044a 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -10,6 +10,8 @@ concurrency:
   group: tests-${{ github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions: {}
+
 jobs:
   tests:
     name: ${{ matrix.os }} / ${{ matrix.python-version }} ${{ matrix.suffix }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7559d93..670a49f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,6 +4,8 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
   build:
     name: Build
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0392b65..35408d4 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -20,12 +20,12 @@ repos:
       - id: check-docstring-first
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.6
+    rev: v0.9.5
     hooks:
       - id: ruff
       - id: ruff-format
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.0.0
+    rev: v1.3.0
     hooks:
       - id: zizmor