diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index ea0b4e5..4c22a52 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -20,7 +20,7 @@ jobs:
 
     strategy:
       matrix:
-        os: ['ubuntu-22.04', 'windows-2019']
+        os: ['ubuntu-22.04', 'windows-2022']
       fail-fast: false
 
     steps:
diff --git a/.github/workflows/octocheese.yml b/.github/workflows/octocheese.yml
index deea6e9..5246961 100644
--- a/.github/workflows/octocheese.yml
+++ b/.github/workflows/octocheese.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: 0 12 * * *
 
+permissions:
+  contents: write
+
 jobs:
   Run:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/python_ci.yml b/.github/workflows/python_ci.yml
index f31486e..e8e18c1 100644
--- a/.github/workflows/python_ci.yml
+++ b/.github/workflows/python_ci.yml
@@ -18,8 +18,8 @@ permissions:
 
 jobs:
   tests:
-    name: "windows-2019 / Python ${{ matrix.config.python-version }}"
-    runs-on: "windows-2019"
+    name: "windows-2022 / Python ${{ matrix.config.python-version }}"
+    runs-on: "windows-2022"
     continue-on-error: ${{ matrix.config.experimental }}
     env:
       USING_COVERAGE: '3.7,3.8,3.9,3.10,3.11,3.12,3.13,pypy-3.7,pypy-3.8,pypy-3.9'
@@ -36,8 +36,8 @@ jobs:
           - {python-version: "3.12", testenvs: "py312,build", experimental: False}
           - {python-version: "3.13", testenvs: "py313,build", experimental: False}
           - {python-version: "pypy-3.7", testenvs: "pypy37,build", experimental: False}
-          - {python-version: "pypy-3.8", testenvs: "pypy38,build", experimental: False}
-          - {python-version: "pypy-3.9-v7.3.15", testenvs: "pypy39,build", experimental: True}
+          - {python-version: "pypy-3.8", testenvs: "pypy38", experimental: False}
+          - {python-version: "pypy-3.9-v7.3.15", testenvs: "pypy39", experimental: True}
 
     steps:
       - name: Checkout 🛎️
diff --git a/.github/workflows/python_ci_linux.yml b/.github/workflows/python_ci_linux.yml
index ba3267e..d474da0 100644
--- a/.github/workflows/python_ci_linux.yml
+++ b/.github/workflows/python_ci_linux.yml
@@ -161,7 +161,7 @@ jobs:
 
       - name: Upload distribution to PyPI 🚀
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/python_ci_macos.yml b/.github/workflows/python_ci_macos.yml
index 9ced940..f4448f9 100644
--- a/.github/workflows/python_ci_macos.yml
+++ b/.github/workflows/python_ci_macos.yml
@@ -28,14 +28,14 @@ jobs:
       fail-fast: False
       matrix:
         config:
-          - {python-version: "3.7", os-ver: "13", testenvs: "py37,build", experimental: False}
+          - {python-version: "3.7", os-ver: "15-intel", testenvs: "py37,build", experimental: False}
           - {python-version: "3.8", os-ver: "14", testenvs: "py38,build", experimental: False}
           - {python-version: "3.9", os-ver: "14", testenvs: "py39,build", experimental: False}
           - {python-version: "3.10", os-ver: "14", testenvs: "py310,build", experimental: False}
           - {python-version: "3.11", os-ver: "14", testenvs: "py311,build", experimental: False}
           - {python-version: "3.12", os-ver: "14", testenvs: "py312,build", experimental: False}
           - {python-version: "3.13", os-ver: "14", testenvs: "py313,build", experimental: False}
-          - {python-version: "pypy-3.7", os-ver: "13", testenvs: "pypy37,build", experimental: False}
+          - {python-version: "pypy-3.7", os-ver: "15-intel", testenvs: "pypy37,build", experimental: False}
           - {python-version: "pypy-3.8", os-ver: "14", testenvs: "pypy38,build", experimental: False}
           - {python-version: "pypy-3.9", os-ver: "14", testenvs: "pypy39,build", experimental: True}
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4bd8c83..8120f58 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -43,7 +43,7 @@ repos:
     - id: bind-requirements
 
  - repo: https://github.com/python-formate/flake8-dunder-all
-   rev: v0.4.1
+   rev: v0.5.0
    hooks:
     - id: ensure-dunder-all
       files: ^cawdrey/.*\.py$
@@ -62,7 +62,7 @@ repos:
     - id: rst-inline-touching-normal
 
  - repo: https://github.com/asottile/pyupgrade
-   rev: v2.12.0
+   rev: v3.3.0
    hooks:
     - id: pyupgrade
       args:
diff --git a/doc-source/requirements.txt b/doc-source/requirements.txt
index 83e10d2..0f8d713 100644
--- a/doc-source/requirements.txt
+++ b/doc-source/requirements.txt
@@ -1,11 +1,13 @@
 git+https://github.com/sphinx-toolbox/sphinx-toolbox-experimental
 default-values>=0.6.0
+docutils<0.22
 domdf-sphinx-theme>=0.3.0
 extras-require>=0.5.0
 html-section>=0.3.0
 mypy>=0.782
 pyyaml>=5.3.1
 repo-helper-sphinx-theme>=0.0.2
+roman>=4.0
 seed-intersphinx-mapping>=1.2.2
 sphinx>=3.0.3
 sphinx-copybutton>=0.2.12
diff --git a/tox.ini b/tox.ini
index 1135513..b4004e9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -68,7 +68,6 @@ download = True
 setenv =
     PYTHONDEVMODE=1
     PIP_DISABLE_PIP_VERSION_CHECK=1
-    UNSAFE_PYO3_SKIP_VERSION_CHECK=1
 
 [testenv:py312]
 download = True
@@ -123,11 +122,12 @@ deps =
     flake8-sphinx-links>=0.0.4
     flake8-strftime>=0.1.1
     flake8-typing-imports>=1.10.0
+    git+https://github.com/domdfcoding/restructuredtext-lint.git@fix-deprecations
     git+https://github.com/domdfcoding/flake8-rst-docstrings-sphinx.git
     git+https://github.com/domdfcoding/flake8-rst-docstrings.git
     git+https://github.com/python-formate/flake8-unused-arguments.git@magic-methods
     git+https://github.com/python-formate/flake8-missing-annotations.git
-    pydocstyle>=6.0.0
+    git+https://github.com/domdfcoding/pydocstyle.git@stub-functions
     pygments>=2.7.1
     importlib_metadata<4.5.0; python_version<'3.8'
 commands = python3 -m flake8_rst_docstrings_sphinx cawdrey tests --allow-toolbox {posargs}