diff --git a/.github/workflows/label-check.yaml b/.github/workflows/label-check.yaml
index d6e97f22..f582ff61 100644
--- a/.github/workflows/label-check.yaml
+++ b/.github/workflows/label-check.yaml
@@ -12,6 +12,8 @@ on:
 env:
   LABELS: ${{ join( github.event.pull_request.labels.*.name, ' ' ) }}
 
+permissions: {}
+
 jobs:
   check-type-label:
     name: ensure type label
diff --git a/.github/workflows/milestone-merged-prs.yaml b/.github/workflows/milestone-merged-prs.yaml
index a5de3f38..210087a1 100644
--- a/.github/workflows/milestone-merged-prs.yaml
+++ b/.github/workflows/milestone-merged-prs.yaml
@@ -10,6 +10,11 @@ on:
 jobs:
   milestone_pr:
     name: attach to PR
+    if: github.event.pull_request.merged == true
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
     runs-on: ubuntu-latest
     steps:
       - uses: scientific-python/attach-next-milestone-action@bc07be829f693829263e57d5e8489f4e57d3d420
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index aeb43c65..328ca82f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # frozen: v5.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-ast
@@ -19,14 +19,14 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: bc7af46104f0f5368b95878decf720f9f00c2559 # frozen: v3.4.2
+    rev: 5ba47274f9b181bce26a5150a725577f3c336011 # frozen: v3.6.2
     hooks:
       - id: prettier
         types_or: [yaml, toml, markdown, css, scss, javascript, json]
         args: [--prose-wrap=preserve]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 73413df07b4ab0bf103ca1ae73c7cec5c0ace593 # frozen: v0.9.2
+    rev: 9c89adb347f6b973f4905a4be0051eb2ecf85dea # frozen: v0.13.3
     hooks:
       - id: ruff
         args:
@@ -39,7 +39,7 @@ repos:
       - id: ruff-format
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: 4dcc98ccce605605fd6d5202bf803a8c8bc34e8d # v1.1.1
+    rev: v1.14.2 # v1.1.1
     hooks:
       - id: zizmor
 
diff --git a/assets/theme-css/pst/variables/_fonts.scss b/assets/theme-css/pst/variables/_fonts.scss
index 9a16122e..e7d3c293 100644
--- a/assets/theme-css/pst/variables/_fonts.scss
+++ b/assets/theme-css/pst/variables/_fonts.scss
@@ -33,11 +33,12 @@ html {
 
   // Font family
   // These are adapted from https://systemfontstack.com/ */
-  --pst-font-family-base-system: -apple-system, "BlinkMacSystemFont",
-    "Segoe UI", "Helvetica Neue", "Arial", sans-serif, "Apple Color Emoji",
-    "Segoe UI Emoji", "Segoe UI Symbol";
-  --pst-font-family-monospace-system: "SFMono-Regular", "Menlo", "Consolas",
-    "Monaco", "Liberation Mono", "Lucida Console", monospace;
+  --pst-font-family-base-system:
+    -apple-system, "BlinkMacSystemFont", "Segoe UI", "Helvetica Neue", "Arial",
+    sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
+  --pst-font-family-monospace-system:
+    "SFMono-Regular", "Menlo", "Consolas", "Monaco", "Liberation Mono",
+    "Lucida Console", monospace;
   --pst-font-family-base: var(--pst-font-family-base-system);
   --pst-font-family-heading: var(--pst-font-family-base-system);
   --pst-font-family-monospace: var(--pst-font-family-monospace-system);
diff --git a/doc/content/examples/kitchen-sink/tables.md b/doc/content/examples/kitchen-sink/tables.md
index 10eb1974..0e0dac4e 100644
--- a/doc/content/examples/kitchen-sink/tables.md
+++ b/doc/content/examples/kitchen-sink/tables.md
@@ -38,7 +38,6 @@ format:
 rows:
 
 - columns:
-
   - "NumPy"
   - |
     Official _source code_ (all platforms) and _binaries_ for<br/>