diff --git a/.cruft.json b/.cruft.json
index 864dff0..fa14ded 100644
--- a/.cruft.json
+++ b/.cruft.json
@@ -1,6 +1,6 @@
 {
   "template": "https://github.com/sunpy/package-template",
-  "commit": "10dab07c799a60c9fa7a948e743450a6883b3dd4",
+  "commit": "07598e4e7ed228c3dc25cf87f07c3decc2a91c15",
   "checkout": null,
   "context": {
     "cookiecutter": {
@@ -36,7 +36,7 @@
         ".github/workflows/zizmor.yml"
       ],
       "_template": "https://github.com/sunpy/package-template",
-      "_commit": "10dab07c799a60c9fa7a948e743450a6883b3dd4"
+      "_commit": "07598e4e7ed228c3dc25cf87f07c3decc2a91c15"
     }
   },
   "directory": null
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 49674dd..6e9a9e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ permissions: {}
 jobs:
   core:
     if: ${{ !github.event.repository.fork || github.event_name != 'schedule' }}
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@3a3dcf3ba6828dac29eba10334948ef38364ed14  # v3.1.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8d5ad7efc8e84a051639373f6ea0d10441eafee1  # v3.2.1
     permissions:
       id-token: write
     with:
@@ -52,14 +52,14 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.13'
-      - run: python -m pip install -U --user build
+      - run: python -m pip install -U --user build twine "validate-pyproject[all]"
+      - run: validate-pyproject pyproject.toml
       - run: python -m build . --sdist
-      - run: python -m pip install -U --user twine
-      - run: python -m twine check dist/*
+      - run: python -m twine check --strict dist/*
 
   test:
     needs: [core, sdist_verify]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@3a3dcf3ba6828dac29eba10334948ef38364ed14  # v3.1.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8d5ad7efc8e84a051639373f6ea0d10441eafee1  # v3.2.1
     permissions:
       id-token: write
     with:
@@ -76,7 +76,7 @@ jobs:
 
   docs:
     needs: [core]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@3a3dcf3ba6828dac29eba10334948ef38364ed14  # v3.1.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8d5ad7efc8e84a051639373f6ea0d10441eafee1  # v3.2.1
     with:
       default_python: '3.13'
       submodules: false
@@ -98,7 +98,7 @@ jobs:
         contains(github.event.pull_request.labels.*.name, 'Run publish')
       )
     needs: [test, docs]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@3a3dcf3ba6828dac29eba10334948ef38364ed14  # v3.1.0
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@8d5ad7efc8e84a051639373f6ea0d10441eafee1  # v3.2.1
     with:
       python-version: '3.13'
       test_extras: 'tests'
@@ -118,7 +118,7 @@ jobs:
       name: pypi
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
         with:
           merge-multiple: true
           pattern: dist-*
@@ -127,7 +127,7 @@ jobs:
       - run: ls -lha dist/
 
       - name: Run upload
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
 
   notify:
     if: ${{ !cancelled() && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 89d4dd8..3f744a3 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -5,6 +5,10 @@ on:
     branches: ["main"]
   pull_request:
     branches: ["**"]
+  # Rescan weekly: an action can be disclosed as vulnerable while the repository is quiet.
+  # Not on the hour: GitHub delays or drops scheduled runs at the start of each hour.
+  schedule:
+    - cron: "17 7 * * 1"
 
 permissions: {}
 
@@ -21,4 +25,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 1d8c969..254e20b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 repos:
     # This should be before any formatting hooks like isort
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "v0.17.0"
+    rev: "v0.17.1"
     hooks:
       - id: ruff-check
         args: ["--fix", "--show-fixes"]