diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index cd0c0b7..0570317 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,8 +1,6 @@
 ---
 name: Build and Test
-
-permissions:
-  contents: read
+permissions: {}
 
 on:
   push:
@@ -20,10 +18,9 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
@@ -32,7 +29,7 @@ jobs:
           components: clippy
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Build
         run: cargo build --release
@@ -49,15 +46,14 @@ jobs:
     needs: [unit-tests]
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: musl-tools
           version: ubuntu-latest
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
@@ -66,7 +62,7 @@ jobs:
           targets: x86_64-unknown-linux-musl
 
       - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: musl
 
diff --git a/.github/workflows/pr_pre-commit.yaml b/.github/workflows/pr_pre-commit.yaml
deleted file mode 100644
index 69dc18c..0000000
--- a/.github/workflows/pr_pre-commit.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
----
-name: pre-commit
-
-on:
-  pull_request:
-  merge_group:
-
-env:
-  CARGO_TERM_COLOR: always
-  RUST_TOOLCHAIN_VERSION: "1.97.1"
-
-jobs:
-  pre-commit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
-        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
-        with:
-          toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
-          components: rustfmt, clippy
-
-      - name: Setup Rust Cache
-        uses: Swatinem/rust-cache@23869a5bd66c73db3c0ac40331f3206eb23791dc # v2.9.1
-
-      - name: Install cargo-deny
-        uses: taiki-e/install-action@7769b73c2ec98c38dfcf2e18c83cfd4880c038c1 # v2.75.27
-        with:
-          tool: cargo-deny
-
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
diff --git a/.github/workflows/pr_prek.yaml b/.github/workflows/pr_prek.yaml
new file mode 100644
index 0000000..4df64a1
--- /dev/null
+++ b/.github/workflows/pr_prek.yaml
@@ -0,0 +1,29 @@
+---
+name: prek
+permissions: {}
+
+on:
+  pull_request:
+  merge_group:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_TOOLCHAIN_VERSION: "1.97.1"
+
+jobs:
+  prek:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
+        with:
+          tool: cargo-deny
+
+      - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0
+        with:
+          rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
diff --git a/.github/workflows/security_audit.yaml b/.github/workflows/security_audit.yaml
index cb68e5b..95a4696 100644
--- a/.github/workflows/security_audit.yaml
+++ b/.github/workflows/security_audit.yaml
@@ -1,5 +1,6 @@
 ---
 name: Daily Security Audit
+permissions: {}
 
 on:
   schedule:
@@ -7,18 +8,17 @@ on:
     - cron: '15 4 * * *'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  issues: write
-
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write # Needed for rustsec/audit-check to publish a check run
+      issues: write # Needed for rustsec/audit-check to file an issue per advisory
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         # Build against stable because cargo-audit sometimes depends on things
diff --git a/Cargo.lock b/Cargo.lock
index 03b1bf8..749d9c6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -387,9 +387,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures",