diff --git a/.copier-answers.yml b/.copier-answers.yml
index e7b3ea0..6648236 100644
--- a/.copier-answers.yml
+++ b/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.26.2
+_commit: v0.27.0
 _src_path: .
 copyright_holder: Stephen Kent
 copyright_license: MIT
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
new file mode 100644
index 0000000..f2e481d
--- /dev/null
+++ b/.github/jactionlint.yaml
@@ -0,0 +1,3 @@
+profile: default
+rules:
+  unpinned-uses: off
diff --git a/.github/workflows/audit.yaml b/.github/workflows/audit.yaml
index 5ac02f3..c6c9cf1 100644
--- a/.github/workflows/audit.yaml
+++ b/.github/workflows/audit.yaml
@@ -10,15 +10,25 @@ on:
     paths:
       - uv.lock
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
 jobs:
   audit:
     name: Dependencies
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '3.15'
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 06cd953..894c579 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -14,6 +17,7 @@ jobs:
   ci:
     name: Test (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: ${{ matrix.python-version }}
     strategy:
@@ -30,6 +34,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 🪪 Configure git identity for tests
         run: |
@@ -71,6 +76,7 @@ jobs:
   docs:
     name: Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '3.15'
     steps:
@@ -78,6 +84,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -99,13 +106,13 @@ jobs:
   betterleaks:
     name: Secret scan
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    timeout-minutes: 15
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -128,13 +135,13 @@ jobs:
     name: Commit messages
     if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
+    timeout-minutes: 15
     steps:
       - name: 💾 Check out repository
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: ✉️ Check commit messages
         uses: commit-check/commit-check-action@v2
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 7e2c14f..4bffccc 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -8,17 +8,16 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
-  group: pages
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: false
 
 jobs:
   build:
     name: Build Documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     env:
       UV_PYTHON: '3.15'
     steps:
@@ -26,6 +25,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 📦 Cache uv managed packages
         uses: actions/cache@v6
@@ -53,9 +53,16 @@ jobs:
     name: Deploy Documentation
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write
+      id-token: write
+    concurrency:
+      group: pages
+      cancel-in-progress: false
     steps:
       - name: 🚀 Deploy site
         uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2f33a9a..f7c74e4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -5,10 +5,19 @@ on:
     tags:
       - v[0-9]*.[0-9]*
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distribution
     runs-on: ubuntu-latest
+    cache-mode: none
+    timeout-minutes: 15
     env:
       UV_PYTHON: '3.15'
     steps:
@@ -16,19 +25,11 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 0
-
-      - name: 📦 Cache uv managed packages
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/uv
-          key: uv-${{ runner.os }}-${{ hashFiles('pyproject.toml', 'uv.lock') }}
-          restore-keys: |
-            uv-${{ runner.os }}-
+          persist-credentials: false
 
       - name: 🍳 Set up mise
         uses: jdx/mise-action@v5
         with:
-          cache: true
           install: true
 
       - name: 📦 Build package
@@ -37,6 +38,7 @@ jobs:
       - name: 🔼 Upload artifact
         uses: actions/upload-artifact@v7
         with:
+          if-no-files-found: error
           name: dist
           path: dist/
 
@@ -44,6 +46,7 @@ jobs:
     name: Create GitHub release
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
     steps:
@@ -54,15 +57,17 @@ jobs:
           path: dist/
 
       - name: 🏷️ Create GitHub release
-        run: gh release create ${{ github.ref_name }} dist/* --generate-notes
+        run: gh release create "${REF_NAME}" dist/* --generate-notes
         env:
           GH_REPO: ${{ github.repository }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
 
   publish:
     name: Publish to PyPI
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment:
       name: pypi
       url: https://pypi.org/project/copier-python/
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 35c5afa..1ad5833 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,6 +28,13 @@ repos:
         entry: betterleaks git . --pre-commit --staged --redact
         language: system
         pass_filenames: false
+      - id: jactionlint
+        name: jactionlint
+        entry: jactionlint --fix
+        language: system
+        types:
+          - yaml
+        files: ^\.github/workflows/
       - id: ruff
         name: ruff
         entry: uv run ruff check --fix
diff --git a/mise.toml b/mise.toml
index 17d7d47..157d3a3 100644
--- a/mise.toml
+++ b/mise.toml
@@ -8,6 +8,7 @@ postinstall = [
 
 [tools]
 betterleaks = "latest"
+jactionlint = "latest"
 "pipx:copier" = "latest"
 prek = "latest"
 taplo = "latest"