diff --git a/.github/workflows/coverage_external_pr.yml b/.github/workflows/coverage_external_pr.yml
index aa804b01..725341b5 100644
--- a/.github/workflows/coverage_external_pr.yml
+++ b/.github/workflows/coverage_external_pr.yml
@@ -1,7 +1,7 @@
 name: Post coverage comment
 
 on:
-  workflow_run:
+  workflow_run:  # zizmor: ignore[dangerous-triggers]
     workflows: ["Run linters and tests"]
     types:
       - completed
diff --git a/.github/workflows/lint_and_test.yml b/.github/workflows/lint_and_test.yml
index c6f2fa23..6c986711 100644
--- a/.github/workflows/lint_and_test.yml
+++ b/.github/workflows/lint_and_test.yml
@@ -24,6 +24,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.11
         uses: actions/setup-python@v5
@@ -67,6 +69,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.11
         uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
@@ -117,6 +121,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
         id: download
diff --git a/.github/workflows/test_all_oses.yml b/.github/workflows/test_all_oses.yml
index 0bb0f792..e2595be8 100644
--- a/.github/workflows/test_all_oses.yml
+++ b/.github/workflows/test_all_oses.yml
@@ -34,6 +34,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.11
         uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 49575636..2da0ee06 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -8,6 +8,8 @@ files: |-
       |(docs/custom_ext/.*)
       |(benchmarks/.*)
       |(scripts/.*)
+      |(.github/.*)
+      |(.pre-commit-config.yaml)
   )$
 
 default_stages:
@@ -32,8 +34,8 @@ repos:
       - id: eradicate
         args: ['-e']  # remove default --in-place argument and emit error
 
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.8.3
+  - repo: 'https://github.com/astral-sh/ruff-pre-commit'
+    rev: v0.9.1
     hooks:
       - id: ruff
         args: [ --fix-only ]
@@ -42,3 +44,24 @@ repos:
     rev: 5.13.2
     hooks:
       - id: isort
+
+  - repo: 'https://github.com/python-jsonschema/check-jsonschema'
+    rev: 0.31.0
+    hooks:
+      - id: check-dependabot
+      - id: check-github-workflows
+
+  - repo: 'https://github.com/rhysd/actionlint'
+    rev: v1.7.3
+    hooks:
+      - id: actionlint
+
+  - repo: 'https://github.com/woodruffw/zizmor-pre-commit'
+    rev: v1.1.1
+    hooks:
+      - id: zizmor
+
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
diff --git a/requirements/dev.txt b/requirements/dev.txt
index d7c96692..6121bedb 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -118,7 +118,7 @@ mdurl==0.1.2
     # via markdown-it-py
 msgspec==0.18.4 ; implementation_name != 'pypy'
     # via -r requirements/raw/bench.txt
-mypy==1.13.0
+mypy==1.14.0
     # via -r requirements/raw/lint.txt
 mypy-extensions==1.0.0
     # via mypy
@@ -202,7 +202,7 @@ radon==6.0.1
     # via -r requirements/raw/lint.txt
 requests==2.32.3
     # via sphinx
-ruff==0.8.3
+ruff==0.9.1
     # via -r requirements/raw/lint.txt
 schematics==2.1.1
     # via -r requirements/raw/bench.txt
diff --git a/requirements/lint.txt b/requirements/lint.txt
index 5d0821bf..e31c4ccf 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -26,7 +26,7 @@ cfgv==3.4.0
     # via pre-commit
 charset-normalizer==3.4.0
     # via requests
-colorama==0.4.6 ; python_full_version >= '3.5'
+colorama==0.4.6
     # via radon
 contourpy==1.3.1
     # via matplotlib
@@ -103,7 +103,7 @@ mdurl==0.1.2
     # via markdown-it-py
 msgspec==0.18.4 ; implementation_name != 'pypy'
     # via -r requirements/raw/bench.txt
-mypy==1.13.0
+mypy==1.14.0
     # via -r requirements/raw/lint.txt
 mypy-extensions==1.0.0
     # via mypy
@@ -176,7 +176,7 @@ radon==6.0.1
     # via -r requirements/raw/lint.txt
 requests==2.32.3
     # via sphinx
-ruff==0.8.3
+ruff==0.9.1
     # via -r requirements/raw/lint.txt
 schematics==2.1.1
     # via -r requirements/raw/bench.txt
diff --git a/requirements/raw/lint.txt b/requirements/raw/lint.txt
index 86f48cee..11f01f85 100644
--- a/requirements/raw/lint.txt
+++ b/requirements/raw/lint.txt
@@ -4,11 +4,11 @@
 
 pre-commit==4.0.1
 
-mypy[faster-cache]==1.13.0
+mypy[faster-cache]==1.14.0
 
 vulture==2.10
 
-ruff==0.8.3
+ruff==0.9.1
 
 radon==6.0.1
 dlint==0.14.1
diff --git a/tests/unit/morphing/generic_provider/test_union_provider.py b/tests/unit/morphing/generic_provider/test_union_provider.py
index 68e757aa..4fa3cd7b 100644
--- a/tests/unit/morphing/generic_provider/test_union_provider.py
+++ b/tests/unit/morphing/generic_provider/test_union_provider.py
@@ -226,7 +226,7 @@ def test_literal(strict_coercion, debug_trail):
     ["other_type", "value", "expected", "wrong_value"],
     [
         (
-         Decimal, Decimal(200.5), "200.5", [1, 2, 3],
+         Decimal, Decimal("200.5"), "200.5", [1, 2, 3],
         ),
         (
          Union[str, Decimal], "some string", "some string", [1, 2, 3],