diff --git a/.github/workflows/rust_quality.yml b/.github/workflows/rust_quality.yml
index ec23198..2141c71 100644
--- a/.github/workflows/rust_quality.yml
+++ b/.github/workflows/rust_quality.yml
@@ -174,10 +174,10 @@ jobs:
       # are scoped to the normal dep graph (what actually ships in the
       # extension module).
       - name: cargo deny check licenses, bans, sources
-        run: cargo deny --manifest-path rust-bindings/Cargo.toml check --config deny.toml licenses bans sources
+        run: cargo deny --manifest-path rust-bindings/Cargo.toml --config deny.toml check licenses bans sources
 
       - name: cargo deny check advisories
-        run: cargo deny --manifest-path rust-bindings/Cargo.toml check --config deny.toml advisories --exclude-dev
+        run: cargo deny --manifest-path rust-bindings/Cargo.toml --config deny.toml --exclude-dev check advisories
 
   third_party_licenses:
     name: THIRD-PARTY-LICENSES check
diff --git a/pyproject.toml b/pyproject.toml
index c8e11c1..b511c9f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -87,7 +87,7 @@ disallow_incomplete_defs = false
 disallow_untyped_calls = false
 show_error_context = true
 strict_equality = false
-python_version = 3.9
+python_version = "3.10"
 warn_redundant_casts = true
 warn_unused_configs = true
 warn_unused_ignores = false
diff --git a/requirements-testing.txt b/requirements-testing.txt
index 166756e..1f466f5 100644
--- a/requirements-testing.txt
+++ b/requirements-testing.txt
@@ -7,14 +7,15 @@ pytest-xdist == 3.8.*
 types-PyYAML ~= 6.0
 # Pinned to 25.x because black 26+ produces different formatting output
 # that is incompatible with black 25 (last version supporting Python 3.9).
-black == 25.11.*
+black == 25.12.*; python_version >= "3.10"
+black == 25.11.*; python_version < "3.10"
 ruff == 0.15.*
-mypy == 2.2.*; python_version >= "3.10"
+mypy == 2.3.*; python_version >= "3.10"
 mypy == 1.19.*; python_version < "3.10"
 # pydantic: required by the legacy model_v0 (Pydantic) test suite,
 # which lives alongside the new Rust-backed model_v1 implementation.
 pydantic >= 2.10, < 3
 # hypothesis: used by the opt-in fuzz test suites in test/openjd/expr
 # and test/openjd/model-v*. conftest.py imports it unconditionally.
-hypothesis ~= 6.156; python_version >= "3.10"
+hypothesis ~= 6.157; python_version >= "3.10"
 hypothesis ~= 6.141; python_version < "3.10"
diff --git a/src/openjd/model/_internal/_variable_reference_validation.py b/src/openjd/model/_internal/_variable_reference_validation.py
index 076e8f5..7298899 100644
--- a/src/openjd/model/_internal/_variable_reference_validation.py
+++ b/src/openjd/model/_internal/_variable_reference_validation.py
@@ -349,6 +349,10 @@ def _validate_model_template_variable_references(
     ):
         return []
 
+    # _issubclass_for_pydantic isn't a TypeGuard, so mypy only narrows `model` to
+    # `type[object]` via isclass(). Re-assert the OpenJDModel subclass narrowing.
+    model = cast(Type[OpenJDModel], model)
+
     # Does this cls change the variable reference scope for itself and its children? If so, then update
     # our scope.
     model_override_scope = cast(ModelPrivateAttr, model._template_variable_scope).get_default()
@@ -763,6 +767,10 @@ def _collect_variable_definitions(  # noqa: C901  (suppress: too complex)
     if not isclass(model) or not _issubclass_for_pydantic(model, OpenJDModel):
         return {"__export__": ScopedSymtabs()}
 
+    # _issubclass_for_pydantic isn't a TypeGuard, so mypy only narrows `model` to
+    # `type[object]` via isclass(). Re-assert the OpenJDModel subclass narrowing.
+    model = cast(Type[OpenJDModel], model)
+
     # If the model has no exported variable definitions, prune it
     if recursive_pruning and "__export__" not in model._template_variable_sources:
         return {"__export__": ScopedSymtabs()}