diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index cf0e689..666aaba 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -11,7 +11,7 @@ jobs:
         - python-version: 3.13
           env:
             TOXENV: pylint
-        - python-version: 3.12  # Keep in sync with .readthedocs.yml
+        - python-version: 3.13  # Keep in sync with .readthedocs.yml
           env:
             TOXENV: docs
         - python-version: 3.13
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 36f80b5..ad470a8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,31 +1,32 @@
 name: Publish
-on: [push]
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+'
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    if: startsWith(github.event.ref, 'refs/tags/')
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cssselect
+
+    permissions:
+      id-token: write
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Set up Python 3.13
+    - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: 3.13
 
-    - name: Check Tag
-      id: check-release-tag
+    - name: Build
       run: |
-        if [[ ${{ github.event.ref }} =~ ^refs/tags/v[0-9]+[.][0-9]+[.][0-9]+(rc[0-9]+|[.]dev[0-9]+)?$ ]]; then
-          echo ::set-output name=release_tag::true
-        fi
+        python -m pip install --upgrade build
+        python -m build
 
     - name: Publish to PyPI
-      if: steps.check-release-tag.outputs.release_tag == 'true'
-      run: |
-        pip install --upgrade setuptools wheel twine
-        python setup.py sdist bdist_wheel
-        export TWINE_USERNAME=__token__
-        export TWINE_PASSWORD=${{ secrets.PYPI_TOKEN }}
-        twine upload dist/*
+      uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b1829a6..66f262f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.9.4
+  rev: v0.9.10
   hooks:
     - id: ruff
       args: [ --fix ]
diff --git a/.readthedocs.yml b/.readthedocs.yml
index 7d13c50..46f5f14 100644
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -4,11 +4,11 @@ sphinx:
   configuration: docs/conf.py
   fail_on_warning: true
 build:
-  os: ubuntu-22.04
+  os: ubuntu-24.04
   tools:
     # For available versions, see:
     # https://docs.readthedocs.io/en/stable/config-file/v2.html#build-tools-python
-    python: "3.12"  # Keep in sync with .github/workflows/checks.yml
+    python: "3.13"  # Keep in sync with .github/workflows/checks.yml
 python:
   install:
     - requirements: docs/requirements.txt
diff --git a/MANIFEST.in b/MANIFEST.in
index 5561683..18022a7 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,4 +1,4 @@
-include AUTHORS CHANGES LICENSE README.rst tox.ini .coveragerc cssselect/py.typed
+include AUTHORS CHANGES LICENSE README.rst tox.ini cssselect/py.typed
 recursive-include docs *
 recursive-include tests *
 prune docs/_build
diff --git a/docs/requirements.txt b/docs/requirements.txt
index d5476d8..21cb2eb 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,2 +1,2 @@
-sphinx==7.2.6
-sphinx-rtd-theme==2.0.0
+sphinx==8.2.3
+sphinx-rtd-theme==3.0.2
diff --git a/pyproject.toml b/pyproject.toml
index 7e43445..fa1a140 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,11 +18,6 @@ exclude_also = [
     "if TYPE_CHECKING:",
 ]
 
-[tool.mypy]
-check_untyped_defs = true
-ignore_missing_imports = true
-no_warn_no_return = true
-
 [tool.pylint.MASTER]
 persistent = "no"
 extension-pkg-allow-list = ["lxml"]
diff --git a/tox.ini b/tox.ini
index 3585406..7746739 100644
--- a/tox.ini
+++ b/tox.ini
@@ -16,7 +16,7 @@ commands =
 [testenv:pylint]
 deps =
     {[testenv]deps}
-    pylint==3.3.4
+    pylint==3.3.5
 commands =
     pylint {posargs: cssselect setup.py tests docs}
 
@@ -30,8 +30,8 @@ commands =
 [testenv:typing]
 deps =
     {[testenv]deps}
-    mypy==1.14.1
-    types-lxml==2024.12.13
+    mypy==1.15.0
+    types-lxml==2025.3.4
 commands =
     mypy --strict {posargs: cssselect tests}
 
@@ -43,8 +43,8 @@ skip_install = true
 [testenv:twinecheck]
 basepython = python3
 deps =
-    twine==5.1.1
-    build==1.2.2
+    twine==6.1.0
+    build==1.2.2.post1
 commands =
     python -m build --sdist
     twine check dist/*