diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..4be56bbf5b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+---
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    commit-message:
+      prefix: ":dependabot: github-actions"
+      include: "scope"
+    cooldown:
+      default-days: 7
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "uv"
+    commit-message:
+      prefix: ":dependabot: uv"
+      include: "scope"
+    cooldown:
+      default-days: 7
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/check-minimal-import.yml b/.github/workflows/check-minimal-import.yml
new file mode 100644
index 0000000000..0d767511bd
--- /dev/null
+++ b/.github/workflows/check-minimal-import.yml
@@ -0,0 +1,48 @@
+name: Check minimal import
+
+on:
+  pull_request:
+    branches:
+      - master
+      - "**dev"
+    paths:
+      - "splink/**"
+      - "pyproject.toml"
+      - "uv.lock"
+
+permissions: {}
+
+jobs:
+  test:
+    name: Check minimal import
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup uv (without cache)
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        with:
+          enable-cache: false
+
+      - name: Install Python 3.12
+        id: install_python312
+        run: uv python install 3.12
+
+      - name: Install dependencies
+        id: install_dependencies
+        run: uv sync --python 3.12 --only-group core
+
+      - name: Check Splink imports
+        id: check_splink_imports
+        run: uv run --only-group core python -c "import splink"
+
+      - name: Check dependencies installed
+        id: check_dependencies_installed
+        run: uv pip list
diff --git a/.github/workflows/check_minimal_import.yml b/.github/workflows/check_minimal_import.yml
deleted file mode 100644
index 4cf19f3aef..0000000000
--- a/.github/workflows/check_minimal_import.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: Check bare-bones install
-on:
-  pull_request:
-    branches:
-      - master
-      - "**dev"
-    paths:
-      - "splink/**"
-      - "pyproject.toml"
-      - "uv.lock"
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    name: Check minimal-dependency Splink import
-    steps:
-      - uses: actions/checkout@v5
-
-      - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
-        with:
-          enable-cache: false
-
-      - name: Install Python 3.10
-        run: uv python install 3.10
-
-      - name: Install dependencies
-        run: uv sync -p 3.10 --only-group core
-
-      - name: Check Splink imports
-        run: uv run --only-group core python -c "import splink"
-
-      - name: Check dependencies installed
-        run: uv pip list
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 0000000000..fb374b0624
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,48 @@
+name: CodeQL analysis
+
+on:
+  pull_request:
+    branches:
+      - master
+      - "**dev"
+  push:
+    branches:
+      - master
+
+permissions: {}
+
+jobs:
+  codeql-analysis:
+    name: CodeQL analysis
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - python
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialise CodeQL
+        id: init_codeql
+        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: CodeQL autobuild
+        id: codeql_autobuild
+        uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+
+      - name: CodeQL analysis
+        id: codeql_analysis
+        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        with:
+          category: "language:${{ matrix.language }}"
diff --git a/.github/workflows/run_demos_examples.yml b/.github/workflows/demo-examples.yml
similarity index 57%
rename from .github/workflows/run_demos_examples.yml
rename to .github/workflows/demo-examples.yml
index be43c46281..79253d0db2 100644
--- a/.github/workflows/run_demos_examples.yml
+++ b/.github/workflows/demo-examples.yml
@@ -1,4 +1,4 @@
-name: Run splink example notebooks
+name: Demo Example Notebooks
 
 on:
   pull_request:
@@ -13,20 +13,29 @@ on:
       - "uv.lock"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   test-notebooks:
+    name: Test ${{ matrix.test-group }} notebook with Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10"]
+        python-version: ["3.12"]
         test-group: ["duckdb", "spark", "sqlite"]
-    name: Test ${{ matrix.test-group }} notebooks with Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -35,14 +44,18 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }} --group demos
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }} --group demos
 
-      - name: Modify Notebooks to reduce data size
+      - name: Reduce notebook size
+        id: reduce_notebook_size
         run: uv run python scripts/reduce_notebook_runtime.py
 
-      - name: Test ${{ matrix.test-group }} example notebooks with pytest
+      - name: Run tests
+        id: run_tests
         run: |
           uv run pytest -vv --nbmake -n=auto --nbmake-kernel=python3 --durations=0 docs/demos/examples/${{ matrix.test-group }}/*ipynb
diff --git a/.github/workflows/run_demos_tutorials.yml b/.github/workflows/demo-tutorials.yml
similarity index 54%
rename from .github/workflows/run_demos_tutorials.yml
rename to .github/workflows/demo-tutorials.yml
index 3d4883471b..acb17f3759 100644
--- a/.github/workflows/run_demos_tutorials.yml
+++ b/.github/workflows/demo-tutorials.yml
@@ -1,4 +1,4 @@
-name: Run splink_demos tutorial notebooks
+name: Demo Tutorials Notebooks
 
 on:
   pull_request:
@@ -10,22 +10,30 @@ on:
       - docs/demos/tutorials/**
       - pyproject.toml
       - "uv.lock"
-
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   test:
+    name: Test tutorial notebooks with Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10"]
-    name: Run tutorial notebooks with Python ${{ matrix.python-version }}
+        python-version: ["3.12"]
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -34,14 +42,18 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }} --group demos
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }} --group demos
 
-      - name: Modify Notebooks to reduce data size
+      - name: Reduce notebook size
+        id: reduce_notebook_size
         run: uv run python scripts/reduce_notebook_runtime.py
 
-      - name: Run tutorial notebooks
+      - name: Run tests
+        id: run_tests
         run: |
           uv run pytest -vv --nbmake -n=auto --nbmake-kernel=python3 docs/demos/tutorials/*ipynb
diff --git a/.github/workflows/test_latest_dependency_versions.yml b/.github/workflows/dependency-canary.yml
similarity index 50%
rename from .github/workflows/test_latest_dependency_versions.yml
rename to .github/workflows/dependency-canary.yml
index b5d261ab97..6ac4f377f0 100644
--- a/.github/workflows/test_latest_dependency_versions.yml
+++ b/.github/workflows/dependency-canary.yml
@@ -5,40 +5,52 @@ on:
     - cron: "0 6 * * *"
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: daily-uv-canary
   cancel-in-progress: true
 
 jobs:
-  canary:
+  dependency-canary:
+    name: Dependency canary
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
 
       - name: Install Python 3.13
+        id: install_python313
         run: uv python install 3.13
+
       - name: Upgrade lockfile
+        id: upgrade_lockfile
         run: uv lock --upgrade
 
       - name: Did uv.lock change?
         id: changed
         run: |
           if git diff --quiet --exit-code -- uv.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "changed=false" >> "${GITHUB_OUTPUT}"
           else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "changed=true" >> "${GITHUB_OUTPUT}"
           fi
 
-      - name: Sync deps from lock
+      - name: Install dependencies
         if: steps.changed.outputs.changed == 'true'
-        run: uv sync -p 3.13
+        id: install_dependencies
+        run: uv sync --python 3.13
 
-      - name: Run basic tests
+      - name: Run tests
         if: steps.changed.outputs.changed == 'true'
-        id: tests
+        id: run_tests
         run: uv run python -m pytest -m "duckdb" tests/
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000000..978a997d0b
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,30 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches:
+      - master
+      - "**dev"
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Dependency Review
+        id: dependency_review
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+        with:
+          comment-summary-in-pr: true
+          fail-on-severity: critical
diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 360c632ffa..cafbbcaa00 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -1,10 +1,9 @@
-name: docswithmkdoc
+name: Documentation
 
 on:
   push:
     branches:
       - master
-
   pull_request:
     branches:
       - master
@@ -16,17 +15,26 @@ on:
       # and potentially dependencies - build is quick so shouldn't be too much pain to run this:
       - pyproject.toml
       - uv.lock
-
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
+    name: Build Documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -34,51 +42,47 @@ jobs:
             uv.lock
 
       - name: Install Python 3.13
+        id: install_python313
         run: uv python install 3.13
 
       - name: Install dependencies
-        run: uv sync --group docs -p 3.13
+        id: install_dependencies
+        run: uv sync --python 3.13 --group docs
 
       - name: Build documentation
+        id: build_documentation
         run: uv run mkdocs build
 
       - name: Check links
-        uses: lycheeverse/lychee-action@v2.0.2
+        id: check_links
+        uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
         with:
           fail: false
           args: --offline site/ --verbose './site/**/*.html'
 
       - name: Upload built site
-        uses: actions/upload-artifact@v4.4.0
+        id: upload_built_site
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
-          name: built_site
           path: site
 
-      # some environment info
-      - run: uv tree
-      - run: uv run mkdocs --version
-
   deploy:
-    runs-on: ubuntu-latest
-    needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: build
+    name: Deploy Documentation to GitHub Pages
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy_pages.outputs.page_url }}
+    permissions:
+      contents: read
+      id-token: write
+      pages: write
     steps:
-      - uses: actions/setup-python@v4
-        with:
-          python-version: 3.13
-
-      - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/download-artifact@v4.1.7
-        with:
-          name: built_site
-          path: site
+      - name: Configure Pages
+        id: configure_pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
-      - name: commit and force-push to gh-pages branch
-        run: |
-          pip install ghp-import==2.1.0
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-          ghp-import -opfm "Update docs from commit ${{ github.sha }}" site
+      - name: Deploy to GitHub Pages
+        id: deploy_pages
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 705e145301..b505dc4e60 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,4 +1,5 @@
-name: autoruff
+name: Lint
+
 on:
   pull_request:
     branches:
@@ -8,15 +9,24 @@ on:
       - "**/*.py"
       - "pyproject.toml"
 
+permissions: {}
+
 jobs:
   lint:
+    name: Lint
     runs-on: ubuntu-latest
-    name: Lint with Ruff using Python 3.12.1
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -24,13 +34,17 @@ jobs:
             uv.lock
 
       - name: Install Python 3.12
+        id: install_python312
         run: uv python install 3.12
 
       - name: Install dependencies
-        run: uv sync -p 3.12
+        id: install_dependencies
+        run: uv sync --python 3.12
 
-      - name: Run Ruff linting
+      - name: Run Ruff lint
+        id: ruff_lint
         run: uv run ruff check . --output-format=full
 
-      - name: Run Ruff formatting check
+      - name: Run Ruff format
+        id: ruff_format
         run: uv run ruff format --check .
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index 287b0dc7e5..430d433176 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -1,4 +1,4 @@
-name: Type hinting with mypy
+name: mypy
 on:
   pull_request:
     branches:
@@ -9,27 +9,38 @@ on:
       - tests/**
       - pyproject.toml
 
+permissions: {}
+
 jobs:
   mypy:
+    name: mypy
     runs-on: ubuntu-latest
-    name: Check type hinting with mypy
+    permissions:
+      contents: read
     steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
             pyproject.toml
             uv.lock
 
-      - name: Install Python 3.10
-        run: uv python install 3.10
+      - name: Install Python 3.12
+        id: install_python312
+        run: uv python install 3.12
 
       - name: Install dependencies
-        run: uv sync -p 3.10
+        id: install_dependencies
+        run: uv sync --python 3.12
 
       - name: Run mypy
+        id: mypy
         run: uv run mypy splink
diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml
index 291c363df6..0721311043 100644
--- a/.github/workflows/pypi-release.yml
+++ b/.github/workflows/pypi-release.yml
@@ -1,23 +1,39 @@
-name: Release Package on PyPi
+name: Release Package to PyPI
+
 on:
   push:
     tags:
       - "v*.*.*"
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
   publish-to-pypi:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
+      - name: Setup uv
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        with:
+          enable-cache: false
 
-      - name: Set up Python
-        run: uv python install 3.11
+      - name: Install Python 3.12
+        id: install_python312
+        run: uv python install 3.12
 
       - name: Install the project
+        id: install_project
         run: uv build --no-sources
 
       - name: Publish to PyPI
-        run: uv publish -t ${{ secrets.PYPI_API_TOKEN }}
+        id: publish_to_pypi
+        run: uv publish --token ${{ secrets.PYPI_API_TOKEN }}
diff --git a/.github/workflows/pytest_duckdb.yml b/.github/workflows/pytest-duckdb.yml
similarity index 58%
rename from .github/workflows/pytest_duckdb.yml
rename to .github/workflows/pytest-duckdb.yml
index 3bff5212a0..6579522681 100644
--- a/.github/workflows/pytest_duckdb.yml
+++ b/.github/workflows/pytest-duckdb.yml
@@ -1,4 +1,5 @@
-name: Duckdb and core tests
+name: Pytest DuckDB
+
 on:
   pull_request:
     branches:
@@ -10,19 +11,28 @@ on:
       - "pyproject.toml"
       - "uv.lock"
 
+permissions: {}
+
 jobs:
   test:
+    name: Pytest DuckDB (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
-    name: Run tests with Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -31,21 +41,27 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }}
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }}
 
       - name: Run tests with coverage
+        id: run_tests
         run: |
           uv run python -m pytest -v --durations=0 -m "duckdb_only or core" --cov=splink --cov-report=xml --cov-report=term tests/
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v4
+        id: upload_coverage_report
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: coverage-report-${{ matrix.python-version }}
           path: coverage.xml
+
       - name: Upload to Codecov
-        uses: codecov/codecov-action@v4
+        id: upload_codecov
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/pytest_postgres.yml b/.github/workflows/pytest-postgres.yml
similarity index 67%
rename from .github/workflows/pytest_postgres.yml
rename to .github/workflows/pytest-postgres.yml
index c270f86478..3a8d36e35b 100644
--- a/.github/workflows/pytest_postgres.yml
+++ b/.github/workflows/pytest-postgres.yml
@@ -1,4 +1,5 @@
-name: Postgres tests
+name: Pytest Postgres
+
 on:
   pull_request:
     branches:
@@ -10,9 +11,14 @@ on:
       - "pyproject.toml"
       - "uv.lock"
 
+permissions: {}
+
 jobs:
   test:
+    name: Pytest Postgres (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       pg_splink_ci:
         image: postgres
@@ -31,12 +37,16 @@ jobs:
       fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
-    name: Run tests with Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -45,10 +55,13 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }}
-
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }}
+  
       - name: Run tests
+        id: run_tests
         run: uv run python -m pytest -v --durations=0 -m "postgres_only" tests/
diff --git a/.github/workflows/pytest_spark.yml b/.github/workflows/pytest-spark.yml
similarity index 60%
rename from .github/workflows/pytest_spark.yml
rename to .github/workflows/pytest-spark.yml
index dc15e5c08c..d2be4491ac 100644
--- a/.github/workflows/pytest_spark.yml
+++ b/.github/workflows/pytest-spark.yml
@@ -1,4 +1,5 @@
-name: Spark tests
+name: Pytest Spark
+
 on:
   pull_request:
     branches:
@@ -10,19 +11,28 @@ on:
       - "pyproject.toml"
       - "uv.lock"
 
+permissions: {}
+
 jobs:
   test:
+    name: Pytest Spark (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
-    name: Run tests with Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -31,11 +41,14 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }}
-
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }}
+  
       - name: Run tests
+        id: run_tests
         run: |
             uv run python -m pytest -v --durations=0 -m "spark_only" tests/
diff --git a/.github/workflows/pytest_sqlite.yml b/.github/workflows/pytest-sqlite.yml
similarity index 54%
rename from .github/workflows/pytest_sqlite.yml
rename to .github/workflows/pytest-sqlite.yml
index 73859d71c2..3d71efbd81 100644
--- a/.github/workflows/pytest_sqlite.yml
+++ b/.github/workflows/pytest-sqlite.yml
@@ -1,4 +1,5 @@
-name: Sqlite tests
+name: Pytest SQLite
+
 on:
   pull_request:
     branches:
@@ -12,17 +13,24 @@ on:
 
 jobs:
   test:
+    name: Pytest SQLite (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
-    name: Run tests with Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup uv (with cache)
-        uses: astral-sh/setup-uv@v6
+        id: setup_uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
         with:
           enable-cache: true
           cache-dependency-glob: |
@@ -31,10 +39,13 @@ jobs:
           cache-suffix: "${{ runner.os }}-${{ matrix.python-version }}"
 
       - name: Install Python ${{ matrix.python-version }}
+        id: install_python
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync -p ${{ matrix.python-version }}
-
+        id: install_dependencies
+        run: uv sync --python ${{ matrix.python-version }}
+  
       - name: Run tests
-        run: uv run pytest -v --durations=0 -m "sqlite_only" tests/
+        id: run_tests
+        run: uv run python -m pytest -v --durations=0 -m "sqlite_only" tests/