diff --git a/.github/workflows/octocheese.yml b/.github/workflows/octocheese.yml
index 208a753..fd909f7 100644
--- a/.github/workflows/octocheese.yml
+++ b/.github/workflows/octocheese.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: 0 12 * * *
 
+permissions:
+  contents: write
+
 jobs:
   Run:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/python_ci.yml b/.github/workflows/python_ci.yml
index 8c29ad2..344c77d 100644
--- a/.github/workflows/python_ci.yml
+++ b/.github/workflows/python_ci.yml
@@ -36,8 +36,8 @@ jobs:
           - {python-version: "3.12", testenvs: "py312-flake8{6,7},build", experimental: False}
           - {python-version: "3.13", testenvs: "py313-flake8{6,7},build", experimental: False}
           - {python-version: "pypy-3.7", testenvs: "pypy37-flake8{4,5},build", experimental: False}
-          - {python-version: "pypy-3.8", testenvs: "pypy38-flake8{4,5,6,7},build", experimental: False}
-          - {python-version: "pypy-3.9-v7.3.15", testenvs: "pypy39-flake8{4,5,6,7},build", experimental: True}
+          - {python-version: "pypy-3.8", testenvs: "pypy38-flake8{4,5,6,7}", experimental: False}
+          - {python-version: "pypy-3.9-v7.3.15", testenvs: "pypy39-flake8{4,5,6,7}", experimental: True}
 
     steps:
       - name: Checkout 🛎️
diff --git a/.github/workflows/python_ci_linux.yml b/.github/workflows/python_ci_linux.yml
index 375441c..3739bed 100644
--- a/.github/workflows/python_ci_linux.yml
+++ b/.github/workflows/python_ci_linux.yml
@@ -161,7 +161,7 @@ jobs:
 
       - name: Upload distribution to PyPI 🚀
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/python_ci_macos.yml b/.github/workflows/python_ci_macos.yml
index ea5934c..1f1cf0a 100644
--- a/.github/workflows/python_ci_macos.yml
+++ b/.github/workflows/python_ci_macos.yml
@@ -28,14 +28,14 @@ jobs:
       fail-fast: False
       matrix:
         config:
-          - {python-version: "3.7", os-ver: "13", testenvs: "py37-flake8{4,5},build", experimental: False}
+          - {python-version: "3.7", os-ver: "15-intel", testenvs: "py37-flake8{4,5},build", experimental: False}
           - {python-version: "3.8", os-ver: "14", testenvs: "py38-flake8{4,5,6,7},build", experimental: False}
           - {python-version: "3.9", os-ver: "14", testenvs: "py39-flake8{4,5,6,7},build", experimental: False}
           - {python-version: "3.10", os-ver: "14", testenvs: "py310-flake8{4,5,6,7},build", experimental: False}
           - {python-version: "3.11", os-ver: "14", testenvs: "py311-flake8{4,5,6,7},build", experimental: False}
           - {python-version: "3.12", os-ver: "14", testenvs: "py312-flake8{6,7},build", experimental: False}
           - {python-version: "3.13", os-ver: "14", testenvs: "py313-flake8{6,7},build", experimental: False}
-          - {python-version: "pypy-3.7", os-ver: "13", testenvs: "pypy37-flake8{4,5},build", experimental: False}
+          - {python-version: "pypy-3.7", os-ver: "15-intel", testenvs: "pypy37-flake8{4,5},build", experimental: False}
           - {python-version: "pypy-3.8", os-ver: "14", testenvs: "pypy38-flake8{4,5,6,7},build", experimental: False}
           - {python-version: "pypy-3.9", os-ver: "14", testenvs: "pypy39-flake8{4,5,6,7},build", experimental: True}
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e730967..6ccad67 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,7 +43,7 @@ repos:
     - id: bind-requirements
 
  - repo: https://github.com/python-formate/flake8-dunder-all
-   rev: v0.4.1
+   rev: v0.5.0
    hooks:
     - id: ensure-dunder-all
       files: ^flake8_github_actions/.*\.py$
@@ -62,11 +62,11 @@ repos:
     - id: rst-inline-touching-normal
 
  - repo: https://github.com/asottile/pyupgrade
-   rev: v2.12.0
+   rev: v3.3.0
    hooks:
     - id: pyupgrade
       args:
-       - --py36-plus
+       - --py37-plus
        - --keep-runtime-typing
 
  - repo: https://github.com/Lucas-C/pre-commit-hooks
diff --git a/tox.ini b/tox.ini
index 8494acd..8de3846 100644
--- a/tox.ini
+++ b/tox.ini
@@ -82,7 +82,6 @@ download = True
 setenv =
     PYTHONDEVMODE=1
     PIP_DISABLE_PIP_VERSION_CHECK=1
-    UNSAFE_PYO3_SKIP_VERSION_CHECK=1
 
 [testenv:py312]
 download = True
@@ -218,7 +217,6 @@ download = True
 setenv =
     PYTHONDEVMODE=1
     PIP_DISABLE_PIP_VERSION_CHECK=1
-    UNSAFE_PYO3_SKIP_VERSION_CHECK=1
 
 [testenv:lint]
 basepython = python3.9