diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e0cdb1..2a16fce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,4 +22,4 @@ jobs:
   style:
     secrets:
       token: ${{ secrets.PAT }}
-    uses: ComPWA/actions/.github/workflows/style.yml@v4.0
+    uses: ComPWA/actions/.github/workflows/style.yml@313866498eb92c341d7e6b905e09f33a5979dffb # v4.1.4
diff --git a/.github/workflows/clean-caches.yml b/.github/workflows/clean-caches.yml
index 1d3abcc..daf35b9 100644
--- a/.github/workflows/clean-caches.yml
+++ b/.github/workflows/clean-caches.yml
@@ -16,7 +16,7 @@ jobs:
     name: Remove caches
     runs-on: ubuntu-slim
     steps:
-      - uses: ComPWA/actions/clean-caches@v4
+      - uses: ComPWA/actions/clean-caches@313866498eb92c341d7e6b905e09f33a5979dffb # v4.1.4
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index ed00e50..93c1c5f 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -16,6 +16,6 @@ on:
 
 jobs:
   lock:
-    uses: ComPWA/actions/.github/workflows/lock.yml@v4
+    uses: ComPWA/actions/.github/workflows/lock.yml@313866498eb92c341d7e6b905e09f33a5979dffb # v4.1.4
     secrets:
       token: ${{ secrets.PAT }}
diff --git a/.github/workflows/pr-linting.yml b/.github/workflows/pr-linting.yml
index e15b56f..621dea1 100644
--- a/.github/workflows/pr-linting.yml
+++ b/.github/workflows/pr-linting.yml
@@ -11,4 +11,4 @@ on:
 
 jobs:
   lint-pr:
-    uses: ComPWA/actions/.github/workflows/pr-linting.yml@v4
+    uses: ComPWA/actions/.github/workflows/pr-linting.yml@313866498eb92c341d7e6b905e09f33a5979dffb # v4.1.4
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index a11f16e..249c1ed 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -13,7 +13,7 @@ repos:
       - id: check-useless-excludes
 
   - repo: https://github.com/ComPWA/policy
-    rev: 0.9.0
+    rev: 0.10.1
     hooks:
       - id: check-dev-files
 
@@ -29,7 +29,7 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/tombi-toml/tombi-pre-commit
-    rev: v1.2.0
+    rev: v1.8.2
     hooks:
       - id: tombi-format
       - id: tombi-lint
@@ -41,7 +41,6 @@ repos:
       - id: prettier
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: v10.0.1
+    rev: v10.3.0
     hooks:
       - id: cspell
-        language_version: 25.9.0
diff --git a/pyproject.toml b/pyproject.toml
index 7bce952..5171024 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,7 +15,7 @@ help = "Run all continuous integration (CI) tasks locally"
 sequence = ["style"]
 
 [tool.poe.tasks.style]
-cmd = "pre-commit run --all-files"
+cmd = "prek run --all-files"
 executor = { type = "simple" }
 help = "Perform all linting, formatting, and spelling checks"
 
@@ -25,7 +25,7 @@ help = "Upgrade lock files"
 parallel = ["_upgrade-precommit"]
 
 [tool.poe.tasks._upgrade-precommit]
-cmd = "pre-commit autoupdate -j8"
+cmd = "prek autoupdate"
 executor = { type = "simple" }
 
 [tool.tombi.format.rules]
@@ -37,5 +37,5 @@ key-empty = "off"
 
 [[tool.tombi.schemas]]
 root = "tool.compwa.policy"
-path = "https://raw.githubusercontent.com/ComPWA/policy/0.9.0/compwa-policy.schema.json"
+path = "https://raw.githubusercontent.com/ComPWA/policy/0.10.1/compwa-policy.schema.json"
 include = ["pyproject.toml"]