diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7818bef342..441d5c7db2 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,14 @@ updates:
       github-actions:
         patterns:
           - '*'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 6116e33631..0ffcffe71a 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -22,14 +22,17 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    env:
+      REF_NAME: ${{ github.ref_name }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
@@ -45,28 +48,29 @@ jobs:
       run: |
         set -e
         pushd docs
+
         make clean html linkcheck
         popd
 
     - name: Update switcher and latest version
       if: ${{ github.event_name == 'release' }}
       run: |
-        python docs/update_switcher.py --version ${{ github.ref_name }}
+        python docs/update_switcher.py --version $REF_NAME
 
     - name: Create PR
       if: ${{ github.event_name == 'release' }}
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
       with:
-        commit-message: "docs: Update switcher.json for ${{ github.ref_name }}"
-        title: "docs: Update switcher.json for ${{ github.ref_name }}"
+        commit-message: "docs: Update switcher.json for $REF_NAME"
+        title: "docs: Update switcher.json for $REF_NAME"
         body: "This PR updates the switcher.json file."
-        branch: "docs/update-switcher-${{ github.ref_name }}"
+        branch: "docs/update-switcher-$REF_NAME"
         base: "main"
         labels: "documentation"
 
     - name: Publish to Github Pages on main
       if: ${{ github.ref == 'refs/heads/main' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
@@ -75,15 +79,15 @@ jobs:
 
     - name: Publish to Github Pages on release (versioned)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
-        destination_dir: ${{ github.ref_name }}
+        destination_dir: $REF_NAME
 
     - name: Publish to Github Pages on release (latest)
       if: ${{ github.event_name == 'release' }}
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/_build/html/
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 748dc8a287..a69940af99 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -18,18 +18,27 @@ defaults:
 jobs:
   packages:
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/folium/
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        # Should be enough for setuptools-scm
+        fetch-depth: 100
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1   # v6.3.0
       with:
         python-version: "3.x"
 
     - name: Get tags
       run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
 
-
     - name: Install build tools
       run: |
         python -m pip install --upgrade pip wheel build twine
@@ -48,7 +57,4 @@ jobs:
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@v1.14.0
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
diff --git a/.github/workflows/save_versions.yml b/.github/workflows/save_versions.yml
index 6707572337..b5f9414a83 100644
--- a/.github/workflows/save_versions.yml
+++ b/.github/workflows/save_versions.yml
@@ -1,5 +1,8 @@
 name: Save package versions
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -9,13 +12,18 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -36,7 +44,7 @@ jobs:
 
     - name: Save versions.txt
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: versions.txt
         path: /tmp/versions.txt
diff --git a/.github/workflows/test_code.yml b/.github/workflows/test_code.yml
index 3576d503ec..1374e6928b 100644
--- a/.github/workflows/test_code.yml
+++ b/.github/workflows/test_code.yml
@@ -1,5 +1,8 @@
 name: Code Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -11,22 +14,27 @@ on:
 jobs:
   run:
     runs-on: ${{ matrix.os }}
+    permissions:
+      actions: write
+
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        python-version: ["3.9", "3.13"]
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        python-version: [ "3.10", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
-        micromamba-version: '2.6.0-0'
         environment-name: TEST
         create-args: >-
           python=${{ matrix.python-version }}
@@ -48,7 +56,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-code-${{ matrix.os }}-${{ matrix.python-version }}
         path: .coverage*
diff --git a/.github/workflows/test_geopandas.yml b/.github/workflows/test_geopandas.yml
index ebef22fa8e..cb0b9d6dd6 100644
--- a/.github/workflows/test_geopandas.yml
+++ b/.github/workflows/test_geopandas.yml
@@ -1,5 +1,8 @@
 name: Geopandas tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -11,20 +14,23 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+
     defaults:
       run:
         shell: bash -l {0}
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
-        # needed to get the correct version number for Folium
         fetch-depth: 0
+        persist-credentials: false
         path: folium
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -32,8 +38,10 @@ jobs:
           --file folium/requirements.txt
 
     - name: Checkout Geopandas
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
+        fetch-depth: 0
+        persist-credentials: false
         repository: geopandas/geopandas
         path: geopandas
 
@@ -54,7 +62,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-geopandas
         path: |
diff --git a/.github/workflows/test_latest_branca.yml b/.github/workflows/test_latest_branca.yml
index 5adaa9e678..c399c2d72f 100644
--- a/.github/workflows/test_latest_branca.yml
+++ b/.github/workflows/test_latest_branca.yml
@@ -1,5 +1,8 @@
 name: Code Tests with Latest branca
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +19,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -38,9 +44,11 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-branca
         path: |
           .coverage*
         include-hidden-files: true
+      permissions:
+        actions: write
diff --git a/.github/workflows/test_mypy.yml b/.github/workflows/test_mypy.yml
index e3cd97af5e..f4ab8f3f19 100644
--- a/.github/workflows/test_mypy.yml
+++ b/.github/workflows/test_mypy.yml
@@ -1,5 +1,9 @@
 name: Mypy type hint checks
 
+# no permissions by default
+permissions: {}
+
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -16,10 +20,13 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml
index 1703560e0c..5f4e6ff7ec 100644
--- a/.github/workflows/test_selenium.yml
+++ b/.github/workflows/test_selenium.yml
@@ -1,5 +1,8 @@
 name: Selenium Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -13,17 +16,22 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ "3.9", "3.13" ]
+        python-version: [ "3.9", "3.14" ]
       fail-fast: false
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -39,7 +47,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-selenium-${{ matrix.python-version }}
         path: |
diff --git a/.github/workflows/test_snapshots.yml b/.github/workflows/test_snapshots.yml
index fc915ddc2f..1bcfccfd9f 100644
--- a/.github/workflows/test_snapshots.yml
+++ b/.github/workflows/test_snapshots.yml
@@ -1,5 +1,8 @@
 name: Run Snapshot Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -12,13 +15,18 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v3
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         create-args: >-
@@ -40,14 +48,14 @@ jobs:
 
     - name: Surface failing tests
       if: always()
-      uses: pmeier/pytest-results-action@main
+      uses: pmeier/pytest-results-action@fdc7f18d9934e38aca411ca9557e6577bd25ca9c  # v0.9.0
       with:
         path: test-results.xml
         fail-on-empty: false
 
     - name: Upload screenshots
       if: failure()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: screenshots
         path: |
@@ -56,7 +64,7 @@ jobs:
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-snapshots
         path: |
diff --git a/.github/workflows/test_streamlit_folium.yml b/.github/workflows/test_streamlit_folium.yml
index ffa20e6b65..304340b94a 100644
--- a/.github/workflows/test_streamlit_folium.yml
+++ b/.github/workflows/test_streamlit_folium.yml
@@ -1,5 +1,8 @@
 name: Run Streamlit Folium Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: "0 13 * * *"
@@ -14,22 +17,29 @@ jobs:
     defaults:
       run:
         shell: bash -l {0}
+    permissions:
+      actions: write
 
     steps:
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1   # v6.3.0
       with:
-        python-version: '3.13'
+        python-version: "3.14"
 
     - name: Checkout Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
 
     - name: Checkout Streamlit Folium
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
+        fetch-depth: 0
+        persist-credentials: false
         repository: randyzwitch/streamlit-folium
         ref: master
         path: streamlit_folium  # Checkout into a subdirectory
@@ -68,14 +78,14 @@ jobs:
 
     - name: Surface failing tests
       if: always()
-      uses: pmeier/pytest-results-action@main
+      uses: pmeier/pytest-results-action@fdc7f18d9934e38aca411ca9557e6577bd25ca9c  # v0.9.0
       with:
         path: streamlit_folium/test-results.xml
         fail-on-empty: false
 
     - name: Upload coverage
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
       with:
         name: coverage-test-streamlit-folium
         path: |
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6372c6b0f2..ff7cc45f39 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -17,7 +17,7 @@ repos:
       files: requirements-dev.txt
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.20
+  rev: v0.15.21
   hooks:
     - id: ruff
 
@@ -44,10 +44,10 @@ repos:
             .*\.json |
         )$
 
-# - repo: https://github.com/woodruffw/zizmor-pre-commit
-#   rev: v1.11.0
-#   hooks:
-#     - id: zizmor
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.26.1
+  hooks:
+    - id: zizmor
 
 ci:
     autofix_commit_msg: |