diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6bacf53..bc1f7a9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,11 +1,23 @@
-
 version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+
+multi-ecosystem-groups:
+  dependencies:
     schedule:
       # Check for updates on the first Sunday of every month, 8PM UTC
       interval: "cron"
       cronjob: "0 20 * * sun#1"
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "dependencies"
     cooldown:
       default-days: 7
diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml
index 9196bac..31dccfd 100644
--- a/.github/workflows/check-pr-template.yml
+++ b/.github/workflows/check-pr-template.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   check-pr-template:
     name: Check PR template
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0f2973a..fa3b1a3 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -33,6 +33,9 @@ on:
         description: "The Zstandard version used for the build."
         value: ${{ jobs.config.outputs.ZSTD_VERSION }}
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: "1"
 
@@ -46,6 +49,12 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  pre-commit:
+    name: Pre-commit checks
+    uses: beeware/.github/.github/workflows/pre-commit-run.yml@main
+    with:
+      pre-commit-source: pre-commit
+
   config:
     runs-on: macOS-latest
     outputs:
@@ -60,10 +69,14 @@ jobs:
       ZSTD_VERSION: ${{ steps.extract.outputs.ZSTD_VERSION }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Extract config variables
         id: extract
+        env:
+          INPUTS_BUILD_NUMBER: ${{ inputs.build-number }}
         run: |
           PYTHON_VER=$(make config | grep "PYTHON_VER=" | cut -d "=" -f 2)
           PYTHON_VERSION=$(make config | grep "PYTHON_VERSION=" | cut -d "=" -f 2)
@@ -73,10 +86,10 @@ jobs:
           OPENSSL_VERSION=$(make config | grep "OPENSSL_VERSION=" | cut -d "=" -f 2)
           XZ_VERSION=$(make config | grep "XZ_VERSION=" | cut -d "=" -f 2)
           ZSTD_VERSION=$(make config | grep "ZSTD_VERSION=" | cut -d "=" -f 2)
-          if [ -z "${{ inputs.build-number }}" ]; then
+          if [ -z "${INPUTS_BUILD_NUMBER}" ]; then
             BUILD_NUMBER=custom
           else
-            BUILD_NUMBER=${{ inputs.build-number }}
+            BUILD_NUMBER=${INPUTS_BUILD_NUMBER}
           fi
 
           echo "PYTHON_VER=${PYTHON_VER}" | tee -a ${GITHUB_OUTPUT}
@@ -98,7 +111,9 @@ jobs:
         platform: ["macOS", "iOS", "tvOS", "watchOS", "visionOS"]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Xcode
         # GitHub recommends explicitly selecting the desired Xcode version:
@@ -110,7 +125,7 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -120,12 +135,14 @@ jobs:
           check-latest: true
 
       - name: Build ${{ matrix.platform }}
+        env:
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
           # Do the build for the requested platform.
-          make ${{ matrix.platform }} BUILD_NUMBER=${{ needs.config.outputs.BUILD_NUMBER }}
+          make ${{ matrix.platform }} BUILD_NUMBER=${BUILD_NUMBER}
 
       - name: Upload build artefacts
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
@@ -145,7 +162,9 @@ jobs:
             briefcase-run-args: ' -d "iPhone 16e::iOS 18.5"'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Xcode
         # GitHub recommends explicitly selecting the desired Xcode version:
@@ -157,14 +176,14 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
           merge-multiple: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -173,10 +192,11 @@ jobs:
           # It's an edge case, but when a new alpha is released, we need to use it ASAP.
           check-latest: true
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: beeware/Python-support-testbed
           path: Python-support-testbed
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
@@ -186,7 +206,11 @@ jobs:
       - name: Run support testbed check
         timeout-minutes: 15
         working-directory: Python-support-testbed
-        run: briefcase run ${{ matrix.platform }} Xcode --test ${{ matrix.briefcase-run-args }} -C support_package=\'../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz\'
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
+        run: |
+          briefcase run ${{ matrix.platform }} Xcode --test ${{ matrix.briefcase-run-args }} -C support_package=\'../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz\'
 
   cpython-testbed:
     name: CPython testbed (${{ matrix.platform }})
@@ -203,10 +227,12 @@ jobs:
             testbed-args: '--simulator "Apple Vision Pro,arch=arm64,OS=2.5"'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
@@ -222,7 +248,7 @@ jobs:
           sudo xcode-select --switch /Applications/Xcode_16.4.app
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -232,10 +258,13 @@ jobs:
           check-latest: true
 
       - name: Unpack support package
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
-          mkdir -p support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          cd support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          tar zxvf ../../../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
+          mkdir -p support/${PYTHON_VER}/${{ matrix.platform }}
+          cd support/${PYTHON_VER}/${{ matrix.platform }}
+          tar zxvf ../../../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz
 
       - name: Run CPython testbed
         timeout-minutes: 15
@@ -268,17 +297,19 @@ jobs:
             multiarch: arm64-iphoneos
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Get build artifact
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
           path: dist
           merge-multiple: true
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           # Appending -dev ensures that we can always build the dev release.
           # It's a no-op for versions that have been published.
@@ -288,26 +319,30 @@ jobs:
           check-latest: true
 
       - name: Unpack support package
+        env:
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
         run: |
-          mkdir -p support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          cd support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}
-          tar zxvf ../../../dist/Python-${{ needs.config.outputs.PYTHON_VER }}-${{ matrix.platform }}-support.${{ needs.config.outputs.BUILD_NUMBER }}.tar.gz
+          mkdir -p support/${PYTHON_VER}/${{ matrix.platform }}
+          cd support/${PYTHON_VER}/${{ matrix.platform }}
+          tar zxvf ../../../dist/Python-${PYTHON_VER}-${{ matrix.platform }}-support.${BUILD_NUMBER}.tar.gz
 
       - name: Run cross-platform environment test
         env:
           PYTHON_CROSS_PLATFORM: ${{ matrix.platform }}
           PYTHON_CROSS_SLICE: ${{ matrix.slice }}
           PYTHON_CROSS_MULTIARCH: ${{ matrix.multiarch }}
+          PYTHON_VER: ${{ needs.config.outputs.PYTHON_VER }}
         run: |
           # Create and activate a native virtual environment
-          python${{ needs.config.outputs.PYTHON_VER }} -m venv cross-venv
+          python${PYTHON_VER} -m venv cross-venv
           source cross-venv/bin/activate
 
           # Install pytest
           python -m pip install pytest
 
           # Convert venv into cross-venv
-          python support/${{ needs.config.outputs.PYTHON_VER }}/${{ matrix.platform }}/Python.xcframework/${{ matrix.slice }}/platform-config/${{ matrix.multiarch }}/make_cross_venv.py cross-venv
+          python support/${PYTHON_VER}/${{ matrix.platform }}/Python.xcframework/${{ matrix.slice }}/platform-config/${{ matrix.multiarch }}/make_cross_venv.py cross-venv
 
           # Run the test suite
           python -m pytest tests
diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml
index e4a99c0..b745d0d 100644
--- a/.github/workflows/new-issue.yml
+++ b/.github/workflows/new-issue.yml
@@ -7,12 +7,16 @@ on:
       - reopened
       - transferred
 
+permissions:
+  issues: write
+  contents: read
+
 jobs:
   add-to-project:
     name: Add issue to BeeWare project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/beeware/projects/1
           github-token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 057dc1a..1fd4702 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -4,14 +4,19 @@ on:
   release:
     types: published
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python environment
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.X"
 
@@ -32,22 +37,25 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          TAG: ${{ steps.build-vars.outputs.TAG }}
+          PYTHON_VER: ${{ steps.build-vars.outputs.PYTHON_VER }}
+          BUILD_NUMBER: ${{ steps.build-vars.outputs.BUILD_NUMBER }}
         run: |
           python -m pip install -U pip
           python -m pip install -U setuptools
           python -m pip install awscli
           # macOS build
-          curl -o macOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-macOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp macOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/macOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-macOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o macOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-macOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp macOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/macOS/Python-${PYTHON_VER}-macOS-support.${BUILD_NUMBER}.tar.gz
           # iOS build
-          curl -o iOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-iOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp iOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/iOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-iOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o iOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-iOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp iOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/iOS/Python-${PYTHON_VER}-iOS-support.${BUILD_NUMBER}.tar.gz
           # tvOS build
-          curl -o tvOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-tvOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp tvOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/tvOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-tvOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o tvOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-tvOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp tvOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/tvOS/Python-${PYTHON_VER}-tvOS-support.${BUILD_NUMBER}.tar.gz
           # watchOS build
-          curl -o watchOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-watchOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp watchOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/watchOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-watchOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o watchOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-watchOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp watchOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/watchOS/Python-${PYTHON_VER}-watchOS-support.${BUILD_NUMBER}.tar.gz
           # visionOS build
-          curl -o visionOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${{ steps.build-vars.outputs.TAG }}/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-visionOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
-          aws s3 cp visionOS-artefact.tar.gz s3://briefcase-support/python/${{ steps.build-vars.outputs.PYTHON_VER }}/visionOS/Python-${{ steps.build-vars.outputs.PYTHON_VER }}-visionOS-support.${{ steps.build-vars.outputs.BUILD_NUMBER }}.tar.gz
+          curl -o visionOS-artefact.tar.gz -L https://github.com/beeware/Python-Apple-support/releases/download/${TAG}/Python-${PYTHON_VER}-visionOS-support.${BUILD_NUMBER}.tar.gz
+          aws s3 cp visionOS-artefact.tar.gz s3://briefcase-support/python/${PYTHON_VER}/visionOS/Python-${PYTHON_VER}-visionOS-support.${BUILD_NUMBER}.tar.gz
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ce5d82a..7a5a23d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -7,6 +7,9 @@ on:
     tags:
       - "*-b*"
 
+permissions:
+  contents: read
+
 jobs:
   config:
     name: Build vars
@@ -30,7 +33,7 @@ jobs:
   ci:
     name: CI
     needs: [config]
-    uses: ./.github/workflows/ci.yaml
+    uses: $/.github/workflows/ci.yaml
     with:
       build-number: ${{ needs.config.outputs.BUILD_NUMBER }}
 
@@ -38,29 +41,46 @@ jobs:
     name: Make Release
     runs-on: ubuntu-latest
     needs: [config, ci]
+    permissions:
+      contents: write
     steps:
       - name: Get build artifacts
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: Python-*
           path: dist
           merge-multiple: true
 
       - name: Create Release
-        uses: ncipollo/release-action@v1.21.0
-        with:
-          name: ${{ needs.ci.outputs.PYTHON_VER }}-${{ needs.config.outputs.BUILD_NUMBER }}
-          tag: ${{ needs.ci.outputs.PYTHON_VER }}-${{ needs.config.outputs.BUILD_NUMBER }}
-          draft: true
-          body: |
-            Build ${{ needs.config.outputs.BUILD_NUMBER }} of the BeeWare support package for Python ${{ needs.ci.outputs.PYTHON_VER }}.
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.ci.outputs.PYTHON_VER }}-${{ needs.config.outputs.BUILD_NUMBER }}
+          BUILD_NUMBER: ${{ needs.config.outputs.BUILD_NUMBER }}
+          PYTHON_VER: ${{ needs.ci.outputs.PYTHON_VER }}
+          PYTHON_VERSION: ${{ needs.ci.outputs.PYTHON_VERSION }}
+          BZIP2_VERSION: ${{ needs.ci.outputs.BZIP2_VERSION }}
+          LIBFFI_VERSION: ${{ needs.ci.outputs.LIBFFI_VERSION }}
+          MPDECIMAL_VERSION: ${{ needs.ci.outputs.MPDECIMAL_VERSION }}
+          OPENSSL_VERSION: ${{ needs.ci.outputs.OPENSSL_VERSION }}
+          XZ_VERSION: ${{ needs.ci.outputs.XZ_VERSION }}
+          ZSTD_VERSION: ${{ needs.ci.outputs.ZSTD_VERSION }}
+        run: |
+          cat > release-notes.md <<EOF
+          Build ${BUILD_NUMBER} of the BeeWare support package for Python ${PYTHON_VER}.
+
+          Includes:
+          * Python ${PYTHON_VERSION}
+          * BZip2 ${BZIP2_VERSION}
+          * libFFI ${LIBFFI_VERSION}
+          * mpdecimal ${MPDECIMAL_VERSION}
+          * OpenSSL  ${OPENSSL_VERSION}
+          * XZ ${XZ_VERSION}
+          * Zstandard ${ZSTD_VERSION}
+          EOF
 
-            Includes:
-            * Python ${{ needs.ci.outputs.PYTHON_VERSION }}
-            * BZip2 ${{ needs.ci.outputs.BZIP2_VERSION }}
-            * libFFI ${{ needs.ci.outputs.LIBFFI_VERSION }}
-            * mpdecimal ${{ needs.ci.outputs.MPDECIMAL_VERSION }}
-            * OpenSSL  ${{ needs.ci.outputs.OPENSSL_VERSION }}
-            * XZ ${{ needs.ci.outputs.XZ_VERSION }}
-            * Zstandard ${{ needs.ci.outputs.ZSTD_VERSION }}
-          artifacts: "dist/*"
+          gh release create "${RELEASE_TAG}" \
+            --title "${RELEASE_TAG}" \
+            --draft \
+            --verify-tag \
+            --notes-file release-notes.md \
+            dist/*
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..b834aff
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      # Allow BeeWare-provided actions to be unpinned. If an attacker is in a
+      # position to exploit those action, they're probably able to exploit
+      # repositories directly; and it's significantly easier for our internal
+      # actions to automatically be the most recent versions.
+      policies:
+        beeware/*: ref-pin
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..8cb7e03
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.29.0
+    hooks:
+      - id: zizmor