diff --git a/.github/workflows/build_wheels.yml b/.github/workflows/build_wheels.yml
index 154f1c1..ca94a0a 100644
--- a/.github/workflows/build_wheels.yml
+++ b/.github/workflows/build_wheels.yml
@@ -6,19 +6,23 @@ on:
     types:
       - published
 
+permissions:
+  contents: read
+
 jobs:
   build_sdist:
     name: Build source distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Build sdist
         run: pipx run build --sdist
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
@@ -31,18 +35,33 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.21.3
+        uses: pypa/cibuildwheel@v3.4.0
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: cibw-wheels-${{ matrix.os }}
           path: ./wheelhouse/*.whl
 
+  list_all_artifacts:
+    needs:
+      - build_wheels
+      - build_sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          # unpacks all CIBW artifacts into dist/
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+      - run: ls -lR dist
+
   upload_pypi:
     needs:
       - build_wheels
@@ -54,7 +73,7 @@ jobs:
     # Comment this line for testing
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           # unpacks all CIBW artifacts into dist/
           pattern: cibw-*
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 27d1d8f..f59183c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -4,11 +4,17 @@ on:
     branches:
       - main
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: 3.x
@@ -16,8 +22,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Install
         run: |
           sudo apt-get install sox ninja-build
@@ -39,6 +46,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -50,8 +59,9 @@ jobs:
     steps:
       - name: Install Build Dependencies
         uses: mymindstorm/setup-emsdk@v14
-      - name: Checkout
-        uses: actions/checkout@v6
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Build
         run: |
           emcmake cmake -S . -B jsbuild
diff --git a/README.md b/README.md
index 9045b3e..9603976 100644
--- a/README.md
+++ b/README.md
@@ -158,8 +158,21 @@ If you don't have Conda, then what you will need to do is:
 
 - now you can build wheels with pip, using the same method mentioned above.
 
+Contributing
+============
+
+We use [Conventional Commits](https://www.conventionalcommits.org/) for our commit messages, and check them using `gitlint`.
+
+We use automated code formatting tools and apply them systematically using `pre-commit`.
+
+Please install and run our Git hooks before making commits and submitting pull requests:
+```
+pre-commit install
+gitlint install-hook
+```
+
 Authors
--------
+=======
 
 SoundSwallower is based on PocketSphinx, which is based on Sphinx-II,
 which is based on Sphinx, which is based on Harpy, and so on, and so