diff --git a/.github/workflows/regen-examples-and-docs.yml b/.github/workflows/regen-examples-and-docs.yml
index 2c138ae6..10228385 100644
--- a/.github/workflows/regen-examples-and-docs.yml
+++ b/.github/workflows/regen-examples-and-docs.yml
@@ -18,6 +18,8 @@ env:
   FORCE_COLOR: 1 # Request colored output from CLI tools supporting it
   CLICOLOR_FORCE: 1 # recognized by uv
 
+permissions: {}
+
 jobs:
   regen_examples_and_docs:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test-website.yml b/.github/workflows/test-website.yml
index 0640c646..90807d69 100644
--- a/.github/workflows/test-website.yml
+++ b/.github/workflows/test-website.yml
@@ -18,6 +18,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test-website:
     runs-on: ubuntu-latest
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2cf366f9..b53701fd 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -12,7 +12,7 @@ repos:
       - id: name-tests-test
         args: [--pytest-test-first]
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.1 # must match pyproject.toml
+    rev: v0.9.4 # must match pyproject.toml
     hooks:
       - id: ruff
       - id: ruff-format
@@ -21,9 +21,9 @@ repos:
     hooks:
       - id: blacken-docs
         language: python # means renovate will update the `additional_dependencies` for the hook
-        additional_dependencies: [black==24.10.0]
+        additional_dependencies: [black==25.1.0]
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.3.0
+    rev: v2.4.1
     hooks:
       - id: codespell
         language: python # means renovate will update the `additional_dependencies` for the hook
@@ -33,7 +33,7 @@ repos:
     hooks:
       - id: clevercsv-standardize
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.43.0
+    rev: v0.44.0
     hooks:
       - id: markdownlint-fix
         args: ["--ignore", "stats_website/.snippets"]
@@ -50,11 +50,11 @@ repos:
     hooks:
       - id: validate-pyproject
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.0.1
+    rev: v1.3.0
     hooks:
       - id: zizmor
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.31.0
+    rev: 0.31.1
     hooks:
       - id: check-github-workflows
       - id: check-renovate
@@ -63,7 +63,7 @@ repos:
           - "json5"
   # `actionlint` hook, for verifying correct syntax in GitHub Actions workflows.
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.6
+    rev: v1.7.7
     hooks:
       - id: actionlint
         additional_dependencies:
diff --git a/pyproject.toml b/pyproject.toml
index 3e0f55a2..7f697888 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -47,17 +47,17 @@ dev = [
     "MarkDown==3.7",
     "mkdocs==1.6.1",
     "mkdocs-macros-plugin==1.3.7",
-    "mkdocs-material==9.5.49",
+    "mkdocs-material==9.5.50",
     "mkdocstrings==0.27.0",
     "mkdocstrings-python==1.13.0",
     "beautifulsoup4>=4,<5",
     "covdefaults==2.3.0",
     "coverage==7.6.10",
     "Markdown>=3,<4",
-    "pyright==1.1.391",
+    "pyright==1.1.393",
     "pytest==8.3.4",
     "pytest-antilru==2.0.0",
-    "pytest-asyncio==0.25.2",
+    "pytest-asyncio==0.25.3",
     "pytest-dependency==0.6.0",
     "pytest-mock==3.14.0",
     "pytest-subtests==0.14.1",