diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml
index c799b9e..c59ea23 100644
--- a/.github/workflows/buildifier.yaml
+++ b/.github/workflows/buildifier.yaml
@@ -12,7 +12,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Install erlang
         run: |
           sudo apt-get update -y
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1c85851..378c194 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -23,7 +23,7 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Erlang (Linux)
         if: runner.os == 'Linux'
         run: |
@@ -42,7 +42,7 @@ jobs:
           echo "Installing Erlang..."
           brew install erlang
       - name: Set up Bazel
-        uses: bazel-contrib/setup-bazel@0.18.0
+        uses: bazel-contrib/setup-bazel@0.19.0
         # No version-related input: this action's valid inputs are bazelisk-version (which
         # Bazel version *fetching tool* to install, not which Bazel itself) plus cache/output
         # knobs -- it has no "version" input despite a previous revision of this file passing
@@ -50,7 +50,7 @@ jobs:
         # Bazel version is resolved by Bazelisk from .bazelversion at the repo root, same as
         # any local `bazel` invocation.
       - name: Mount Bazel cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cache/bazel
@@ -212,7 +212,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: pre-commit/action@v3.0.1
   conclusion:
     name: Test Conclusion
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index be4a07a..ff9a686 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -21,7 +21,7 @@ on:
         type: string
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.1.0
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v1.4.1
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b06ec93..4efaf76 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ permissions:
   contents: write
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.4.0
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
     with:
       bazel_test_command: "echo 'Skipping tests'"
       release_files: muchq_rules_gleam-*.tar.gz
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index dfe0aad..1b76045 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -25,7 +25,7 @@ jobs:
       new-tag: ${{ steps.ccv.outputs.new-tag }}
       new-tag-version: ${{steps.ccv.outputs.new-tag-version}}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3935fb2..6af62f0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -30,13 +30,13 @@ repos:
       - id: trailing-whitespace
   # Check formatting and lint for starlark code
   - repo: https://github.com/keith/pre-commit-buildifier
-    rev: 8.2.1
+    rev: 8.5.1
     hooks:
       - id: buildifier
       - id: buildifier-lint
   # Enforce that commit messages allow for later changelog generation
   - repo: https://github.com/commitizen-tools/commitizen
-    rev: v4.13.8
+    rev: v4.16.4
     hooks:
       # Requires that commitizen is already installed
       - id: commitizen
@@ -54,6 +54,6 @@ repos:
             .bcr/config.yml
           )
   - repo: https://github.com/crate-ci/typos
-    rev: v1.43.5
+    rev: v1.48.0
     hooks:
       - id: typos
diff --git a/MODULE.bazel b/MODULE.bazel
index 7f0bef5..d545e51 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -3,7 +3,6 @@
 module(
     name = "muchq_rules_gleam",
     version = "0.0.0",
-    compatibility_level = 1,
 )
 
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
diff --git a/test/unit/erlang_otp_tree/erlang_otp_tree_test.bzl b/test/unit/erlang_otp_tree/erlang_otp_tree_test.bzl
index baee01a..a2ac414 100644
--- a/test/unit/erlang_otp_tree/erlang_otp_tree_test.bzl
+++ b/test/unit/erlang_otp_tree/erlang_otp_tree_test.bzl
@@ -46,7 +46,7 @@ def _bundles_runfiles_relative_path_when_otp_tree_present_test_impl(ctx):
     # This exact shape is what gleam_release got wrong before PR #85: it must be a
     # runfiles-relative path (quoted, joined with $RF and the workspace name), never the
     # toolchain's own absolute build-machine path.
-    asserts.equals(env, '"$RF/my_ws/external/foo/otp/bin/erl"', invocation)
+    asserts.equals(env, '"$RF/my_ws/external/foo/otp/bin/erl"', invocation)  # buildifier: disable=external-path
     asserts.equals(env, files, extra_runfiles)
     return unittest.end(env)