diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index ea0b4e5..4c22a52 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -20,7 +20,7 @@ jobs:
 
     strategy:
       matrix:
-        os: ['ubuntu-22.04', 'windows-2019']
+        os: ['ubuntu-22.04', 'windows-2022']
       fail-fast: false
 
     steps:
diff --git a/.github/workflows/octocheese.yml b/.github/workflows/octocheese.yml
index b99a60a..be5ab7b 100644
--- a/.github/workflows/octocheese.yml
+++ b/.github/workflows/octocheese.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: 0 12 * * *
 
+permissions:
+  contents: write
+
 jobs:
   Run:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/python_ci.yml b/.github/workflows/python_ci.yml
index 0a08672..7ef4422 100644
--- a/.github/workflows/python_ci.yml
+++ b/.github/workflows/python_ci.yml
@@ -18,8 +18,8 @@ permissions:
 
 jobs:
   tests:
-    name: "windows-2019 / Python ${{ matrix.config.python-version }}"
-    runs-on: "windows-2019"
+    name: "windows-2022 / Python ${{ matrix.config.python-version }}"
+    runs-on: "windows-2022"
     continue-on-error: ${{ matrix.config.experimental }}
     env:
       USING_COVERAGE: '3.7,3.8,3.9,3.10,3.11,3.12,3.13'
diff --git a/.github/workflows/python_ci_linux.yml b/.github/workflows/python_ci_linux.yml
index ff89a2b..80bee22 100644
--- a/.github/workflows/python_ci_linux.yml
+++ b/.github/workflows/python_ci_linux.yml
@@ -158,7 +158,7 @@ jobs:
 
       - name: Upload distribution to PyPI 🚀
         if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/python_ci_macos.yml b/.github/workflows/python_ci_macos.yml
index 440ba09..90b96e3 100644
--- a/.github/workflows/python_ci_macos.yml
+++ b/.github/workflows/python_ci_macos.yml
@@ -28,7 +28,7 @@ jobs:
       fail-fast: False
       matrix:
         config:
-          - {python-version: "3.7", os-ver: "13", testenvs: "py37,build", experimental: False}
+          - {python-version: "3.7", os-ver: "15-intel", testenvs: "py37,build", experimental: False}
           - {python-version: "3.8", os-ver: "14", testenvs: "py38,build", experimental: False}
           - {python-version: "3.9", os-ver: "14", testenvs: "py39,build", experimental: False}
           - {python-version: "3.10", os-ver: "14", testenvs: "py310,build", experimental: False}
diff --git a/tox.ini b/tox.ini
index d3e5362..1894a87 100644
--- a/tox.ini
+++ b/tox.ini
@@ -54,7 +54,6 @@ download = True
 setenv =
     PYTHONDEVMODE=1
     PIP_DISABLE_PIP_VERSION_CHECK=1
-    UNSAFE_PYO3_SKIP_VERSION_CHECK=1
 
 [testenv:py312]
 download = True
@@ -93,7 +92,7 @@ basepython = python3.9
 ignore_errors = True
 changedir = {toxinidir}
 deps =
-    mypy==0.971
+    mypy==1.17.1
     -r{toxinidir}/tests/requirements.txt
 commands = mypy pprint36 tests {posargs}