diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8d3e069..d311506 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,7 @@
 name: Lint
 
 on:
-  - pull_request_target
+  - pull_request
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -23,7 +23,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Set up Python
-        uses: actions/setup-python@v3
+        uses: actions/setup-python@v5
         with:
           python-version: 3.11
 
@@ -31,7 +31,7 @@ jobs:
         run: pip install pytest ruff black
 
       - name: Format with clang-format
-        uses: DoozyX/clang-format-lint-action@v0.11
+        uses: DoozyX/clang-format-lint-action@v0.18
         with:
           source: "./src"
           extensions: "c"
@@ -46,7 +46,7 @@ jobs:
           version: "~= 23.0"
 
       - name: Format with ruff
-        uses: chartboost/ruff-action@v1
+        uses: astral-sh/ruff-action@v1
         with:
           src: "./src"
           args: check --fix
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8351225..0021077 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
 
       - name: Check if release needed
         id: release
-        uses: python-semantic-release/python-semantic-release@v8.7.2
+        uses: python-semantic-release/python-semantic-release@v9.10.0
         with:
           force: "patch"
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -65,7 +65,7 @@ jobs:
           git branch --set-upstream-to=${RELEASE_PR_BRANCH}
 
       - name: Semantic release
-        uses: python-semantic-release/python-semantic-release@v8.7.2
+        uses: python-semantic-release/python-semantic-release@v9.10.0
         if: steps.release.outputs.released == 'true'
         with:
           force: "patch"
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index efd7915..5fd87fa 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -100,6 +100,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: manylinux_x86_64
+          - os: ubuntu-22.04
+            python: "3.13"
+            python_id: cp313
+            platform_id: manylinux_x86_64
 
           # 🐧 manylinux aarch64
           - os: ubicloud-standard-2-arm
@@ -118,6 +122,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: manylinux_aarch64
+          - os: ubicloud-standard-2-arm
+            python: "3.13"
+            python_id: cp313
+            platform_id: manylinux_aarch64
 
           # 🐧 manylinux2014 PyPy x86_64
           - os: ubuntu-22.04
@@ -156,6 +164,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: musllinux_x86_64
+          - os: ubuntu-22.04
+            python: "3.13"
+            python_id: cp313
+            platform_id: musllinux_x86_64
 
           # 🦀 musllinux ARM
           - os: ubicloud-standard-2-arm
@@ -174,6 +186,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: musllinux_aarch64
+          - os: ubicloud-standard-2-arm
+            python: "3.13"
+            python_id: cp313
+            platform_id: musllinux_aarch64
 
           # 🍎 macOS x86_64
           - os: macos-12-xl
@@ -192,6 +208,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: macosx_x86_64
+          - os: macos-12-xl
+            python: "3.13"
+            python_id: cp313
+            platform_id: macosx_x86_64
 
           # 🍎 macOS arm64 (Apple silicon)
           # XXX: ☠️ https://github.com/actions/setup-python/issues/696
@@ -211,6 +231,10 @@ jobs:
             python: "3.12"
             python_id: cp312
             platform_id: macosx_arm64
+          - os: flyci-macos-large-latest-m1
+            python: "3.13"
+            python_id: cp313
+            platform_id: macosx_arm64
 
     steps:
       - name: Checkout python-hyperscan
@@ -229,7 +253,7 @@ jobs:
       # as it's already the default upstream version; so we only need to use
       # it for other versions, and only on ARM.
       - if: ${{ endsWith(matrix.os, '-arm') && !endsWith(matrix.python_id, '310') }}
-        uses: deadsnakes/action@v3.1.0
+        uses: deadsnakes/action@v3.2.0
         with:
           python-version: ${{ matrix.python }}
 
diff --git a/pyproject.toml b/pyproject.toml
index 054acd3..434826e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -169,6 +169,7 @@ classifiers = [
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: Implementation :: CPython",
   "Environment :: Console",
   "Intended Audience :: Developers",
diff --git a/tox.ini b/tox.ini
index e38ab4e..766030a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py35,py36,py37,py38
+envlist = py35,py36,py37,py38,py39,py310,py311,py312,py313
 skipsdist = true
 
 [testenv]
@@ -13,6 +13,10 @@ basepython =
   py36: python3.6
   py37: python3.7
   py38: python3.8
+  py310: python3.10
+  py311: python3.11
+  py312: python3.12
+  py313: python3.13
 
 [testenv:docs]
 basepython = python3.8