diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 306d7fb6..15a36cf9 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -6,11 +6,11 @@ on:
 
 jobs:
   call-workflow-dependabot-auto-merge:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
+    uses: ./.github/workflows/reusable-dependabot-auto-merge.yml
     permissions:
       contents: write
       pull-requests: write
       statuses: write
       checks: read
     with:
-      dependabot-group: mirageo-ci-tools
+      dependabot-groups: mirageo-ci-tools,pre-commit-hooks
diff --git a/.github/workflows/reusable-dependabot-auto-merge.yml b/.github/workflows/reusable-dependabot-auto-merge.yml
index 1edd5ff7..9d6ff3ed 100644
--- a/.github/workflows/reusable-dependabot-auto-merge.yml
+++ b/.github/workflows/reusable-dependabot-auto-merge.yml
@@ -6,11 +6,11 @@ name: Dependabot auto-merge
 on:
   workflow_call:
     inputs:
-      dependabot-group:
+      dependabot-groups:
         required: false
         type: string
-        default: mirageo-ci-tools
-        description: The Dependabot group name (from dependabot.yml) allowed to auto-merge
+        default: mirageo-ci-tools,pre-commit-hooks
+        description: Comma-separated list of Dependabot group names (from dependabot.yml) allowed to auto-merge
       checks-to-skip:
         required: false
         type: string
@@ -24,14 +24,41 @@ permissions:
   checks: read
 
 jobs:
-  auto-merge:
+  validate-group:
     if: >
       github.event.pull_request.user.login == 'dependabot[bot]' &&
-      startsWith(github.event.pull_request.head.ref, 'dependabot/github_actions/') &&
-      contains(github.event.pull_request.head.ref, format('/{0}', inputs.dependabot-group)) &&
+      startsWith(github.event.pull_request.head.ref, 'dependabot/') &&
       startsWith(github.event.pull_request.title, 'Bump ')
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    outputs:
+      is_allowed_group: ${{ steps.check.outputs.is_allowed_group }}
+    steps:
+      - name: Check Dependabot group
+        id: check
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          GROUPS: ${{ inputs.dependabot-groups }}
+        run: |
+          # Dependabot names grouped-update branches "dependabot/<ecosystem>/<target>/<group>-<hash>",
+          # e.g. "dependabot/pre_commit/main/pre-commit-hooks-251825f045".
+          branch_suffix="${HEAD_REF##*/}"
+          allowed=false
+          IFS=',' read -ra groups <<< "$GROUPS"
+          for group in "${groups[@]}"; do
+            group=$(echo "$group" | xargs)
+            if [ -n "$group" ] && [[ "$branch_suffix" =~ ^${group}-[0-9a-f]+$ ]]; then
+              allowed=true
+              break
+            fi
+          done
+          echo "is_allowed_group=$allowed" >> "$GITHUB_OUTPUT"
+
+  auto-merge:
+    needs: validate-group
+    if: needs.validate-group.outputs.is_allowed_group == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
     - name: Check update type
diff --git a/.github/workflows/reusable-jira-pr_actions.yml b/.github/workflows/reusable-jira-pr_actions.yml
index 09f55162..78239b0a 100644
--- a/.github/workflows/reusable-jira-pr_actions.yml
+++ b/.github/workflows/reusable-jira-pr_actions.yml
@@ -84,10 +84,15 @@ jobs:
     - name: Determine bot PR exemption
       id: bot_exemption
       env:
-        IS_DEPENDABOT: ${{ contains(fromJSON('["dependabot[bot]", "atlassian[bot]"]'), github.event.sender.login) && startsWith(github.head_ref, 'dependabot/github_actions/') && contains(github.head_ref, '/mirageo-ci-tools') }}
+        # atlassian[bot] is accepted alongside each bot because github.event.sender is the
+        # actor that fired this specific webhook delivery, not the PR author: when Jira's
+        # GitHub integration re-fires a pull_request event on one of these bot PRs, the
+        # sender becomes atlassian[bot] and the exemption would otherwise be lost.
+        IS_DEPENDABOT_ON_GH_ACTION: ${{ contains(fromJSON('["dependabot[bot]", "atlassian[bot]"]'), github.event.sender.login) && startsWith(github.head_ref, 'dependabot/github_actions/') && contains(github.head_ref, '/mirageo-ci-tools') }}
+        IS_DEPENDABOT_ON_PRECOMMIT: ${{ contains(fromJSON('["dependabot[bot]", "atlassian[bot]"]'), github.event.sender.login) && startsWith(github.head_ref, 'dependabot/pre_commit') && contains(github.head_ref, '/pre-commit-hooks') }}
         IS_PRECOMMIT: ${{ contains(fromJSON('["pre-commit-ci[bot]", "atlassian[bot]"]'), github.event.sender.login) && github.head_ref == 'pre-commit-ci-update-config' }}
       run: |
-        if [[ "$IS_DEPENDABOT" == "true" || "$IS_PRECOMMIT" == "true" ]]; then
+        if [[ "$IS_DEPENDABOT_ON_GH_ACTION" == "true" || "$IS_DEPENDABOT_ON_PRECOMMIT" == "true" || "$IS_PRECOMMIT" == "true" ]]; then
           echo "is_exempt=true" >> "$GITHUB_OUTPUT"
         else
           echo "is_exempt=false" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/reusable-pre_commit.yml b/.github/workflows/reusable-pre_commit.yml
index 1452b8c6..bf23b14f 100644
--- a/.github/workflows/reusable-pre_commit.yml
+++ b/.github/workflows/reusable-pre_commit.yml
@@ -81,14 +81,24 @@ jobs:
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
+      - name: Check if pre-commit config changed
+        if: ${{ github.event_name == 'pull_request' }}
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          changed_files=$(git diff --diff-filter=AM --name-only refs/remotes/origin/${BASE_REF}... --)
+          if echo "$changed_files" | grep -qxE '\.pre-commit-config\.ya?ml'; then
+            echo "::notice::.pre-commit-config.yaml changed: forcing pre-commit to run on all files"
+            echo "FORCE_ALL_FILES=true" >> $GITHUB_ENV
+          fi
       - name: Run pre-commit on modified files
-        if: ${{ (github.event_name == 'pull_request') }}
+        if: ${{ github.event_name == 'pull_request' && !env.FORCE_ALL_FILES }}
         env:
           BASE_REF: ${{ github.base_ref }}
         run: |
           uv tool run pre-commit run --hook-stage pre-push --from-ref refs/remotes/origin/${BASE_REF} --to-ref .
       - name: Run pre-commit on all files
-        if: ${{ github.event_name == 'push' }}
+        if: ${{ github.event_name == 'push' || env.FORCE_ALL_FILES }}
         run: |
           uv tool run pre-commit run --hook-stage pre-push --all-files
       - name: Run git diff
diff --git a/.github/workflows/reusable-zizmor-advanced-security.yml b/.github/workflows/reusable-zizmor-advanced-security.yml
index e720fa8d..1c6376d8 100644
--- a/.github/workflows/reusable-zizmor-advanced-security.yml
+++ b/.github/workflows/reusable-zizmor-advanced-security.yml
@@ -39,7 +39,7 @@ jobs:
         uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
 
       - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
         with:
           advanced-security: true
           annotations: false
diff --git a/.github/workflows/reusable-zizmor-annotate.yml b/.github/workflows/reusable-zizmor-annotate.yml
index 5e33e43d..12d0f13a 100644
--- a/.github/workflows/reusable-zizmor-annotate.yml
+++ b/.github/workflows/reusable-zizmor-annotate.yml
@@ -39,7 +39,7 @@ jobs:
         uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
 
       - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
         with:
           advanced-security: false
           annotations: true
diff --git a/.github/workflows/reusable-zizmor-security.yml b/.github/workflows/reusable-zizmor-security.yml
index 797fe7fa..31ad66af 100644
--- a/.github/workflows/reusable-zizmor-security.yml
+++ b/.github/workflows/reusable-zizmor-security.yml
@@ -38,7 +38,7 @@ jobs:
         uses: MiraGeoscience/CI-tools/.github/actions/setup-zizmor-config@3ff92aeffa5b92d646abea073ed5ad06117e57f6 # v3.11.0
 
       - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # 0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
         with:
           advanced-security: false
           annotations: false