diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 4365b2b..bf840ba 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -2,39 +2,20 @@
 on:
   pull_request:
   merge_group:
+  push:
+    branches:
+      - master
+
+name: pre-commit
+
 jobs:
   pre-commit:
-    name: "pre-commit"
-    runs-on: github-ubuntu-latest-s
+    runs-on: sonar-xs
     permissions:
       id-token: write
-      contents: write
+      contents: read
     steps:
-      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - uses: SonarSource/ci-github-actions/config-pip@master # dogfood
-      - name: Export pip index for isolated hook venvs
-        run: |
-          index_url="$(python3 -c 'import configparser, pathlib; c = configparser.ConfigParser(); c.read(pathlib.Path.home() / ".pip" / "pip.conf"); print(c["global"]["index-url"])')"
-          echo "::add-mask::${index_url}"
-          {
-            echo "PIP_INDEX_URL=${index_url}"
-            echo "VIRTUALENV_INDEX_URL=${index_url}"
-            echo "VIRTUALENV_PIP=embed"
-            echo "VIRTUALENV_SETUPTOOLS=embed"
-            echo "VIRTUALENV_WHEEL=embed"
-            echo "VIRTUALENV_DOWNLOAD=false"
-            echo "PIP_TRUSTED_HOST=repox.jfrog.io"
-          } >> "$GITHUB_ENV"
-      - uses: SonarSource/ci-github-actions/config-npm@master # dogfood
-      - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          version: 2025.12.13
-      - uses: SonarSource/gh-action_pre-commit@0ecedc4e4070444a95f6b6714ddc3ebcdde697c4 # 1.1.0
-        with:
-          extra-args: >
-            --from-ref=origin/${{ github.event.pull_request.base.ref }} --to-ref=${{ github.event.pull_request.head.sha }}
-
-          ignore-failure: ${{ github.event_name == 'merge_group' }}
+          fetch-depth: 0
+      - uses: SonarSource/gh-action_pre-commit@master