diff --git a/requirements/lint.txt b/requirements/lint.txt
index b4ae77b517..51f9a2ca52 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -6,9 +6,9 @@
 # Lint tools
 # (We are not so interested in the specific versions of the tools: the versions
 # are pinned to prevent unexpected linting failures when tools update)
-ruff==0.9.10
+ruff==0.11.0
 mypy==1.15.0
-zizmor==1.4.1
+zizmor==1.5.1
 
 # Required for type stubs
 freezegun==1.5.1
diff --git a/tuf/api/dsse.py b/tuf/api/dsse.py
index 493fefd1d0..8f812d0741 100644
--- a/tuf/api/dsse.py
+++ b/tuf/api/dsse.py
@@ -81,7 +81,7 @@ def from_bytes(cls, data: bytes) -> SimpleEnvelope[T]:
         except Exception as e:
             raise DeserializationError from e
 
-        return cast(SimpleEnvelope[T], envelope)
+        return cast("SimpleEnvelope[T]", envelope)
 
     def to_bytes(self) -> bytes:
         """Return envelope as JSON bytes.
@@ -150,4 +150,4 @@ def get_signed(self) -> T:
         except Exception as e:
             raise DeserializationError from e
 
-        return cast(T, inner_cls.from_dict(payload_dict))
+        return cast("T", inner_cls.from_dict(payload_dict))
diff --git a/tuf/api/metadata.py b/tuf/api/metadata.py
index 76b5ce0fde..d03a501546 100644
--- a/tuf/api/metadata.py
+++ b/tuf/api/metadata.py
@@ -199,7 +199,7 @@ def from_dict(cls, metadata: dict[str, Any]) -> Metadata[T]:
 
         return cls(
             # Specific type T is not known at static type check time: use cast
-            signed=cast(T, inner_cls.from_dict(metadata.pop("signed"))),
+            signed=cast("T", inner_cls.from_dict(metadata.pop("signed"))),
             signatures=signatures,
             # All fields left in the metadata dict are unrecognized.
             unrecognized_fields=metadata,
diff --git a/tuf/ngclient/_internal/trusted_metadata_set.py b/tuf/ngclient/_internal/trusted_metadata_set.py
index 3678ddf3a1..179a65ed87 100644
--- a/tuf/ngclient/_internal/trusted_metadata_set.py
+++ b/tuf/ngclient/_internal/trusted_metadata_set.py
@@ -145,22 +145,22 @@ def __iter__(self) -> Iterator[Signed]:
     @property
     def root(self) -> Root:
         """Get current root."""
-        return cast(Root, self._trusted_set[Root.type])
+        return cast("Root", self._trusted_set[Root.type])
 
     @property
     def timestamp(self) -> Timestamp:
         """Get current timestamp."""
-        return cast(Timestamp, self._trusted_set[Timestamp.type])
+        return cast("Timestamp", self._trusted_set[Timestamp.type])
 
     @property
     def snapshot(self) -> Snapshot:
         """Get current snapshot."""
-        return cast(Snapshot, self._trusted_set[Snapshot.type])
+        return cast("Snapshot", self._trusted_set[Snapshot.type])
 
     @property
     def targets(self) -> Targets:
         """Get current top-level targets."""
-        return cast(Targets, self._trusted_set[Targets.type])
+        return cast("Targets", self._trusted_set[Targets.type])
 
     # Methods for updating metadata
     def update_root(self, data: bytes) -> Root:
diff --git a/tuf/ngclient/updater.py b/tuf/ngclient/updater.py
index 2504c86aa4..a98e799ce4 100644
--- a/tuf/ngclient/updater.py
+++ b/tuf/ngclient/updater.py
@@ -459,7 +459,7 @@ def _load_targets(self, role: str, parent_role: str) -> Targets:
 
         # Avoid loading 'role' more than once during "get_targetinfo"
         if role in self._trusted_set:
-            return cast(Targets, self._trusted_set[role])
+            return cast("Targets", self._trusted_set[role])
 
         try:
             data = self._load_local_metadata(role)