diff --git a/.github/workflows/test-windows.yml b/.github/workflows/test-windows.yml
index bf8ec2f2c..bfa4c7cd3 100644
--- a/.github/workflows/test-windows.yml
+++ b/.github/workflows/test-windows.yml
@@ -84,7 +84,7 @@ jobs:
         python3 -m pip install --upgrade pip
 
     - name: Install CPython dependencies
-      if: "!contains(matrix.python-version, 'pypy') && matrix.architecture != 'x86'"
+      if: "!contains(matrix.python-version, 'pypy') && !contains(matrix.python-version, '3.14') && matrix.architecture != 'x86'"
       run: |
         python3 -m pip install PyQt6
 
@@ -98,8 +98,8 @@ jobs:
         choco install nasm --no-progress
         echo "C:\Program Files\NASM" >> $env:GITHUB_PATH
 
-        choco install ghostscript --version=10.5.0 --no-progress
-        echo "C:\Program Files\gs\gs10.05.0\bin" >> $env:GITHUB_PATH
+        choco install ghostscript --version=10.5.1 --no-progress
+        echo "C:\Program Files\gs\gs10.05.1\bin" >> $env:GITHUB_PATH
 
         # Install extra test images
         xcopy /S /Y Tests\test-images\* Tests\images
diff --git a/.github/workflows/wheels-dependencies.sh b/.github/workflows/wheels-dependencies.sh
index bc8a0bb9e..ccff94965 100755
--- a/.github/workflows/wheels-dependencies.sh
+++ b/.github/workflows/wheels-dependencies.sh
@@ -38,7 +38,7 @@ ARCHIVE_SDIR=pillow-depends-main
 
 # Package versions for fresh source builds
 FREETYPE_VERSION=2.13.3
-HARFBUZZ_VERSION=11.1.0
+HARFBUZZ_VERSION=11.2.1
 LIBPNG_VERSION=1.6.47
 JPEGTURBO_VERSION=3.1.0
 OPENJPEG_VERSION=2.5.3
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..5bdc48c30
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,7 @@
+# Configuration for the zizmor static analysis tool, run via pre-commit in CI
+# https://woodruffw.github.io/zizmor/configuration/
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 140ce33be..e15e6f639 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.4
+    rev: v0.11.8
     hooks:
       - id: ruff
         args: [--exit-non-zero-on-fix]
@@ -24,7 +24,7 @@ repos:
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v20.1.0
+    rev: v20.1.3
     hooks:
       - id: clang-format
         types: [c]
@@ -51,14 +51,14 @@ repos:
         exclude: ^.github/.*TEMPLATE|^Tests/(fonts|images)/
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.32.1
+    rev: 0.33.0
     hooks:
       - id: check-github-workflows
       - id: check-readthedocs
       - id: check-renovate
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.5.2
+    rev: v1.6.0
     hooks:
       - id: zizmor
 
diff --git a/Tests/test_image_resample.py b/Tests/test_image_resample.py
index ce6209c0d..73b25ed51 100644
--- a/Tests/test_image_resample.py
+++ b/Tests/test_image_resample.py
@@ -462,7 +462,7 @@ class TestCoreResampleBox:
         im.resize((32, 32), resample, (20, 20, 20, 100))
         im.resize((32, 32), resample, (20, 20, 100, 20))
 
-        with pytest.raises(TypeError, match="must be sequence of length 4"):
+        with pytest.raises(TypeError, match="must be (sequence|tuple) of length 4"):
             im.resize((32, 32), resample, (im.width, im.height))  # type: ignore[arg-type]
 
         with pytest.raises(ValueError, match="can't be negative"):
diff --git a/depends/install_libavif.sh b/depends/install_libavif.sh
index fc10d3e54..26af8a36c 100755
--- a/depends/install_libavif.sh
+++ b/depends/install_libavif.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
-version=1.2.1
+version=1.3.0
 
 ./download-and-extract.sh libavif-$version https://github.com/AOMediaCodec/libavif/archive/refs/tags/v$version.tar.gz
 
diff --git a/setup.py b/setup.py
index 5ecd6b816..5d41e27d9 100644
--- a/setup.py
+++ b/setup.py
@@ -46,7 +46,7 @@ WEBP_ROOT = None
 ZLIB_ROOT = None
 FUZZING_BUILD = "LIB_FUZZING_ENGINE" in os.environ
 
-if sys.platform == "win32" and sys.version_info >= (3, 14):
+if sys.platform == "win32" and sys.version_info >= (3, 15):
     import atexit
 
     atexit.register(
diff --git a/winbuild/build_prepare.py b/winbuild/build_prepare.py
index c0d6c483b..e5c52712b 100644
--- a/winbuild/build_prepare.py
+++ b/winbuild/build_prepare.py
@@ -116,7 +116,7 @@ V = {
     "BROTLI": "1.1.0",
     "FREETYPE": "2.13.3",
     "FRIBIDI": "1.0.16",
-    "HARFBUZZ": "11.1.0",
+    "HARFBUZZ": "11.2.1",
     "JPEGTURBO": "3.1.0",
     "LCMS2": "2.17",
     "LIBAVIF": "1.3.0",
@@ -392,6 +392,7 @@ DEPS: dict[str, dict[str, Any]] = {
         "filename": f"libavif-{V['LIBAVIF']}.zip",
         "license": "LICENSE",
         "build": [
+            "rustup update",
             f"{sys.executable} -m pip install meson",
             *cmds_cmake(
                 "avif_static",