diff --git a/.github/workflows/reusable-smoke-test.yml b/.github/workflows/reusable-smoke-test.yml
index 969c768..1d607a8 100644
--- a/.github/workflows/reusable-smoke-test.yml
+++ b/.github/workflows/reusable-smoke-test.yml
@@ -26,6 +26,19 @@ env:
     PYTEST_THEME_MODE
 
 jobs:
+  legit-pr:
+
+    runs-on: ubuntu-latest
+
+    timeout-minutes: 1
+
+    steps:
+    - name: Fail on PRs against illegal branches (`${{ github.base_ref }}`)
+      if: >-
+        github.event_name == 'pull_request'
+        && github.base_ref != github.event.repository.default_branch
+      run: exit 1
+
   fail-fast:
 
     strategy:
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3c1009e..72a7a0c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -10,7 +10,7 @@ repos:
   - id: add-trailing-comma
 
 - repo: https://github.com/PyCQA/isort.git
-  rev: 5.13.2
+  rev: 6.0.0
   hooks:
   - id: isort
     args:
@@ -22,7 +22,7 @@ repos:
   - id: remove-tabs
 
 - repo: https://github.com/python-jsonschema/check-jsonschema.git
-  rev: 0.29.2
+  rev: 0.31.1
   hooks:
   - id: check-github-actions
   - id: check-github-workflows
@@ -37,7 +37,7 @@ repos:
   - id: check-readthedocs
 
 - repo: https://github.com/pre-commit/pre-commit-hooks.git
-  rev: v4.6.0
+  rev: v5.0.0
   hooks:
   # Side-effects:
   - id: end-of-file-fixer
@@ -62,7 +62,7 @@ repos:
     language_version: python3
 
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.2.6
+  rev: v2.4.1
   hooks:
   - id: codespell
 
@@ -78,7 +78,7 @@ repos:
     - --strict
 
 - repo: https://github.com/PyCQA/flake8.git
-  rev: 7.0.0
+  rev: 7.1.1
   hooks:
   - id: flake8
     args:
@@ -111,13 +111,12 @@ repos:
       WPS453,
     - --max-module-members=8  # WPS202
     additional_dependencies:
-    - flake8-2020 ~= 1.7.0
-    - flake8-pytest-style ~= 1.6.0
-    - wemake-python-styleguide ~= 0.19.0
-    language_version: python3.11  # flake8-commas doesn't work w/ Python 3.12
+    - flake8-2020 ~= 1.8.1
+    - flake8-pytest-style ~= 2.1.0
+    - wemake-python-styleguide ~= 1.0.0
 
 - repo: https://github.com/PyCQA/pylint.git
-  rev: v3.3.0
+  rev: v3.3.4
   hooks:
   - id: pylint
     args:
diff --git a/Dockerfile b/Dockerfile
index 3f9f4b8..5fb7097 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.13-slim
 
 LABEL "maintainer" "Sviatoslav Sydorenko <wk+pypa@sydorenko.org.ua>"
 LABEL "repository" "https://github.com/pypa/gh-action-pypi-publish"
@@ -12,7 +12,7 @@ ENV PIP_NO_CACHE_DIR 1
 ENV PIP_ROOT_USER_ACTION ignore
 
 ENV PATH "/root/.local/bin:${PATH}"
-ENV PYTHONPATH "/root/.local/lib/python3.12/site-packages"
+ENV PYTHONPATH "/root/.local/lib/python3.13/site-packages"
 
 COPY requirements requirements
 RUN \
diff --git a/attestations.py b/attestations.py
index 69cc3fb..41f2752 100644
--- a/attestations.py
+++ b/attestations.py
@@ -82,8 +82,8 @@ def assert_attestations_do_not_pre_exist(
 
     existing_attestations_list = '\n'.join(map(str, existing_attestations))
     error_message = (
-        'The following distributions already have publish attestations:'
-        f'{existing_attestations_list}',
+        'The following distributions already have publish attestations: '
+        f'{existing_attestations_list}'
     )
     die(error_message)
 
diff --git a/requirements/runtime-prerequisites.in b/requirements/runtime-prerequisites.in
index 02a2071..a1b589e 100644
--- a/requirements/runtime-prerequisites.in
+++ b/requirements/runtime-prerequisites.in
@@ -1 +1 @@
-pip-with-requires-python
+pip
diff --git a/requirements/runtime-prerequisites.txt b/requirements/runtime-prerequisites.txt
index 1839741..5d0d7fd 100644
--- a/requirements/runtime-prerequisites.txt
+++ b/requirements/runtime-prerequisites.txt
@@ -1,12 +1,10 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
 #    pip-compile --allow-unsafe --config=../.pip-tools.toml --output-file=runtime-prerequisites.txt --strip-extras runtime-prerequisites.in
 #
-pip-with-requires-python==1.0.1
-    # via -r runtime-prerequisites.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==24.0
-    # via pip-with-requires-python
+pip==24.3.1
+    # via -r runtime-prerequisites.in
diff --git a/requirements/runtime.txt b/requirements/runtime.txt
index 303cc3c..f472fcd 100644
--- a/requirements/runtime.txt
+++ b/requirements/runtime.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
 #    pip-compile --allow-unsafe --config=../.pip-tools.toml --output-file=runtime.txt --strip-extras runtime.in
@@ -147,7 +147,6 @@ typing-extensions==4.12.2
     # via
     #   pydantic
     #   pydantic-core
-    #   pyopenssl
 urllib3==2.3.0
     # via
     #   requests