diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml
index 6a240638b..ffd5a6880 100644
--- a/.github/actions.lock.yaml
+++ b/.github/actions.lock.yaml
@@ -1,5 +1,5 @@
 version: 1
-generated_at: 2026-06-15T13:14:55Z
+generated_at: 2026-08-21T11:40:11Z
 internal: []
 trusted:
   - action: actions/checkout
@@ -8,14 +8,7 @@ trusted:
     occurrences:
       ee0669bd1cc54295c223e0bb666b733df41de1c5:
         .github/workflows/docker-build.yml:
-          - jobs.build.steps.[0].uses
-        .github/workflows/python-package.yml:
-          - jobs.build.steps.[0].uses
-  - action: actions/setup-python
-    refs:
-      - d09bd5e6005b175076f227b13d9730d56e9dcfcb
-    occurrences:
-      d09bd5e6005b175076f227b13d9730d56e9dcfcb:
+          - jobs.build.steps.[1].uses
         .github/workflows/python-package.yml:
           - jobs.build.steps.[1].uses
 external:
@@ -25,7 +18,24 @@ external:
     occurrences:
       0e68818ea37ba7728f417f03a58e06e68d9d2592:
         .github/workflows/docker-build.yml:
-          - jobs.build.steps.[1].uses
+          - jobs.build.steps.[2].uses
+  - action: step-security/harden-runner
+    refs:
+      - 9af89fc71515a100421586dfdb3dc9c984fbf411
+    occurrences:
+      9af89fc71515a100421586dfdb3dc9c984fbf411:
+        .github/workflows/docker-build.yml:
+          - jobs.build.steps.[0].uses
+        .github/workflows/python-package.yml:
+          - jobs.build.steps.[0].uses
+  - action: step-security/mise-action
+    refs:
+      - 2796166110dee826668caddd4bffedae5116e7cd
+    occurrences:
+      2796166110dee826668caddd4bffedae5116e7cd:
+        .github/workflows/python-package.yml:
+          - jobs.build.steps.[2].uses
 local: []
 docker: []
 dynamic: []
+nested_floating_deps: []
diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 887c9d6ff..7cc7f4a3b 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -29,10 +29,15 @@ jobs:
         api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }}
 
     - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@d09bd5e6005b175076f227b13d9730d56e9dcfcb # v4.0.0
+    - name: Setup mise
+      uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4
+      env:
+        MISE_PYTHON_GITHUB_ATTESTATIONS: false
       with:
-        python-version: ${{ matrix.python-version }}
+        version: '2026.8.12'
+        mise_toml: |
+          [tools]
+          python = "${{ matrix.python-version }}"
 
     - name: Install dependencies
       run: |
diff --git a/.gitignore b/.gitignore
index afcc5f967..01a7c6897 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,5 @@ legacy/err.egg-info/
 
 # tox
 .tox
+
+.github/actions.lock.yaml
diff --git a/mise.lock b/mise.lock
new file mode 100644
index 000000000..0a4be2ce5
--- /dev/null
+++ b/mise.lock
@@ -0,0 +1,43 @@
+# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
+
+lockfile_version = 1
+
+[[tools.python]]
+version = "3.10.21"
+backend = "core:python"
+specifiers = ["3.10"]
+
+[tools.python."platforms.linux-arm64"]
+checksum = "sha256:686077ed8d668e3446f03f202bc3c99955d350a0db0ace5f8ce45f1b451b54b7"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-arm64-musl"]
+checksum = "sha256:d0310c4f190680a16bf6ca1dc05211f1455d2b2aa6e1fadc7ea721c9471b9b0c"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-unknown-linux-musl-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-x64"]
+checksum = "sha256:807bb6746dd8b7a347fe833ee1cc2543457e5c2c98059dc454600468ee7cae7b"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.linux-x64-musl"]
+checksum = "sha256:05bddd8942f4dfec45e37c8cd72c8b6323e2c7015be6e1f509904762430957fc"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-unknown-linux-musl-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.macos-arm64"]
+checksum = "sha256:caac2a0459052a3f62857fe29809a8fc4a9da87ca5ac860120c7ce710fc43842"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-aarch64-apple-darwin-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.macos-x64"]
+checksum = "sha256:735ec45b5315c1255d425582b63a7819d660783ba0f5402793998908d70a7893"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-apple-darwin-install_only_stripped.tar.gz"
+provenance = "github-attestations"
+
+[tools.python."platforms.windows-x64"]
+checksum = "sha256:35645afc6bac0a8b74f16d36df1a98e36afa71eb8ba64acb7944b3135bcba1c4"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20260814/cpython-3.10.21+20260814-x86_64-pc-windows-msvc-install_only_stripped.tar.gz"
+provenance = "github-attestations"
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 000000000..6f3b64ab7
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,2 @@
+[tools]
+python = "3.10"
diff --git a/setup.py b/setup.py
index 2c3055ff8..f1992f76f 100755
--- a/setup.py
+++ b/setup.py
@@ -30,9 +30,9 @@
     "webtest==3.0.0",
     "setuptools==60.5.0",
     "flask==2.0.2",
+    "werkzeug==2.0.3",  # flask 2.0.2 imports werkzeug.urls.url_quote, removed in werkzeug>=2.1
     "requests==2.27.1",
     "jinja2==3.0.3",
-    "pyOpenSSL==21.0.0",
     "colorlog==6.6.0",
     "markdown==3.3.6",
     "ansi==0.2.0",
@@ -44,6 +44,11 @@
 
 if py_version < (3, 8):
     deps.append("importlib-metadata==4.12.0")
+    # 26.2.0 requires Python >=3.8; 21.0.0 breaks against the latest
+    # cryptography it resolves unpinned (AttributeError: GEN_EMAIL)
+    deps.append("pyOpenSSL==24.0.0")
+else:
+    deps.append("pyOpenSSL==26.2.0")
 
 if py_version < (3, 9):
     deps.append("graphlib-backport==1.0.3")