diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 99ba747..98a2b2b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,9 +2,9 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
   schedule:
     - cron: "25 21 * * 5"
 
@@ -20,11 +20,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ python ]
+        language: [python]
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/macos-arm.yaml b/.github/workflows/macos-arm.yaml
index 367cb22..f785470 100644
--- a/.github/workflows/macos-arm.yaml
+++ b/.github/workflows/macos-arm.yaml
@@ -73,6 +73,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -88,7 +90,11 @@ jobs:
         run: echo "TOXENV=py$(echo ${{ matrix.python-version }} | tr -d '.')-torch$(echo ${{ matrix.torch-version }} | tr -d '.')" >> $GITHUB_ENV
 
       - name: Print TOXENV
-        run: echo "TOXENV is set to '${{ env.TOXENV }}'."
+        run: echo "TOXENV is set to '${TOXENV}'."
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Unittests with tox
-        run: tox -e ${{ env.TOXENV }}
+        run: tox -e $TOXENV
+        env:
+          TOXENV: ${{ env.TOXENV }}
diff --git a/.github/workflows/macos-x86.yaml b/.github/workflows/macos-x86.yaml
index acdef16..5aa3799 100644
--- a/.github/workflows/macos-x86.yaml
+++ b/.github/workflows/macos-x86.yaml
@@ -84,6 +84,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -99,7 +101,11 @@ jobs:
         run: echo "TOXENV=py$(echo ${{ matrix.python-version }} | tr -d '.')-torch$(echo ${{ matrix.torch-version }} | tr -d '.')" >> $GITHUB_ENV
 
       - name: Print TOXENV
-        run: echo "TOXENV is set to '${{ env.TOXENV }}'."
+        run: echo "TOXENV is set to '${TOXENV}'."
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Unittests with tox
-        run: tox -e ${{ env.TOXENV }}
+        run: tox -e $TOXENV
+        env:
+          TOXENV: ${{ env.TOXENV }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 748fc97..6f996b3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -33,6 +33,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Build wheel (bdist)
         run: pipx run build --wheel
@@ -47,6 +49,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Build source distribution (sdist)
         run: pipx run build --sdist
diff --git a/.github/workflows/ubuntu.yaml b/.github/workflows/ubuntu.yaml
index 2aaae45..1f8d91f 100644
--- a/.github/workflows/ubuntu.yaml
+++ b/.github/workflows/ubuntu.yaml
@@ -90,6 +90,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -105,13 +107,17 @@ jobs:
         run: echo "TOXENV=py$(echo ${{ matrix.python-version }} | tr -d '.')-torch$(echo ${{ matrix.torch-version }} | tr -d '.')" >> $GITHUB_ENV
 
       - name: Print TOXENV
-        run: echo "TOXENV is set to '${{ env.TOXENV }}'."
+        run: echo "TOXENV is set to '${TOXENV}'."
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Unittests with tox
-        run: tox -e ${{ env.TOXENV }}
+        run: tox -e $TOXENV
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # 5.1.1
         if: >
           matrix.python-version == '3.11' &&
           matrix.torch-version == '2.2.2' &&
diff --git a/.github/workflows/windows.yaml b/.github/workflows/windows.yaml
index a967b68..e6cd6a6 100644
--- a/.github/workflows/windows.yaml
+++ b/.github/workflows/windows.yaml
@@ -82,6 +82,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
@@ -97,7 +99,11 @@ jobs:
         run: echo "TOXENV=py$(echo ${{ matrix.python-version }} | tr -d '.')-torch$(echo ${{ matrix.torch-version }} | tr -d '.')" >> $GITHUB_ENV
 
       - name: Print TOXENV
-        run: echo "TOXENV is set to '${{ env.TOXENV }}'."
+        run: echo "TOXENV is set to '${TOXENV}'."
+        env:
+          TOXENV: ${{ env.TOXENV }}
 
       - name: Unittests with tox
-        run: tox -e ${{ env.TOXENV }}
+        run: tox -e $TOXENV
+        env:
+          TOXENV: ${{ env.TOXENV }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 690f372..323d74b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -38,7 +38,7 @@ repos:
             --min-py-version,
             "3.8",
             --max-py-version,
-            "3.11",
+            "3.12",
           ]
 
   - repo: https://github.com/asottile/pyupgrade
@@ -60,10 +60,14 @@ repos:
       - id: black
         stages: [pre-commit]
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v0.9.2
+    hooks:
+      - id: zizmor
+
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: v1.13.0
     hooks:
       - id: mypy
-        additional_dependencies: [types-all]
         pass_filenames: false
         args: [--config-file=pyproject.toml, --ignore-missing-imports, src]
diff --git a/src/tad_dftd3/data/radii.py b/src/tad_dftd3/data/radii.py
index 0766e07..ac729c3 100644
--- a/src/tad_dftd3/data/radii.py
+++ b/src/tad_dftd3/data/radii.py
@@ -29,7 +29,7 @@
 from tad_mctc._version import __tversion__
 from tad_mctc.data.radii import COV_D3
 
-from ..typing import Tensor
+from ..typing import Any, Tensor
 
 __all__ = ["COV_D3", "VDW_D3"]
 
@@ -52,7 +52,7 @@ def _load_vdw_rad_d3(
     Tensor
         VDW radii.
     """
-    kwargs: dict = {"map_location": device}
+    kwargs: dict[str, Any] = {"map_location": device}
     if __tversion__ > (1, 12, 1):  # pragma: no cover
         kwargs["weights_only"] = True
 
diff --git a/src/tad_dftd3/reference.py b/src/tad_dftd3/reference.py
index 56bcc3c..ba277bf 100644
--- a/src/tad_dftd3/reference.py
+++ b/src/tad_dftd3/reference.py
@@ -48,6 +48,7 @@ def _load_cn(
     Tensor
         Reference coordination numbers.
     """
+    # fmt: off
     return torch.tensor(
         [
             [-1.0000, -1.0000, -1.0000, -1.0000, -1.0000, -1.0000, -1.0000],  # None
@@ -158,6 +159,7 @@ def _load_cn(
         device=device,
         dtype=dtype,
     )
+    # fmt: on
 
 
 def _load_c6(
@@ -178,7 +180,7 @@ def _load_c6(
     Tensor
         Reference C6 coefficients.
     """
-    kwargs: dict = {"map_location": device}
+    kwargs: dict[str, Any] = {"map_location": device}
     if __tversion__ > (1, 12, 1):  # pragma: no cover
         kwargs["weights_only"] = True
 
diff --git a/test/test_model/test_reference.py b/test/test_model/test_reference.py
index db8353c..b92c7c6 100644
--- a/test/test_model/test_reference.py
+++ b/test/test_model/test_reference.py
@@ -15,7 +15,7 @@
 """
 Test the reference.
 """
-from typing import Optional
+from typing import Optional, Union
 from unittest.mock import patch
 
 import pytest