diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 0f06e16..ff77ae6 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -15,6 +15,9 @@ env:
 
 jobs:
   pre-commit:
+    permissions:
+      contents: read
+      pull-requests: write
     name: linting
     runs-on: ubuntu-latest
     steps:
@@ -22,12 +25,12 @@ jobs:
     - uses: actions/setup-python@v5
       with:
         python-version: 3.x
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  #v3.0.1
       with:
         extra_args: --all-files --show-diff-on-failure
       env:
         PRE_COMMIT_COLOR: always
-    - uses: pre-commit-ci/lite-action@v1.0.2
+    - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43  #v1.1.0
       if: always()
       with:
         msg: Apply pre-commit code formatting
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 34c09e5..655d569 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,6 +12,9 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: read
+      pull-requests: write
     strategy:
       # We want to see all failures:
       fail-fast: false
@@ -21,7 +24,6 @@ jobs:
         config:
         # [Python version, tox env]
         - ["3.11", "release-check"]
-        - ["3.8", "py38"]
         - ["3.9", "py39"]
         - ["3.10", "py310"]
         - ["3.11", "py311"]
@@ -34,6 +36,8 @@ jobs:
     name: ${{ matrix.config[1] }}
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
diff --git a/.meta.toml b/.meta.toml
index ac0bea9..fd09f80 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/pure-python
 [meta]
 template = "pure-python"
-commit-id = "baf6089f"
+commit-id = "82ed9fd9"
 
 [python]
 with-sphinx-doctests = false
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7ab398c..55afc3d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,19 +3,19 @@
 minimum_pre_commit_version: '3.6'
 repos:
   - repo: https://github.com/pycqa/isort
-    rev: "5.13.2"
+    rev: "6.0.0"
     hooks:
     - id: isort
   - repo: https://github.com/hhatto/autopep8
-    rev: "v2.3.1"
+    rev: "v2.3.2"
     hooks:
     - id: autopep8
       args: [--in-place, --aggressive, --aggressive]
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.17.0
+    rev: v3.19.1
     hooks:
     - id: pyupgrade
-      args: [--py38-plus]
+      args: [--py39-plus]
   - repo: https://github.com/isidentical/teyit
     rev: 0.4.3
     hooks:
diff --git a/CHANGES.rst b/CHANGES.rst
index 66bc88f..0b03023 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,7 +4,7 @@ Changes
 2.2 (unreleased)
 ----------------
 
-- Nothing changed yet.
+- Drop support for Python 3.8.
 
 
 2.1 (2024-11-29)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 31d95f0..0ab12fe 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,7 +1,7 @@
 <!--
 Generated from:
 https://github.com/zopefoundation/meta/tree/master/config/pure-python
---> 
+-->
 # Contributing to zopefoundation projects
 
 The projects under the zopefoundation GitHub organization are open source and
diff --git a/pyproject.toml b/pyproject.toml
index 4c0d9ca..5df7ce9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,7 +3,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/pure-python
 
 [build-system]
-requires = ["setuptools < 74"]
+requires = ["setuptools <= 75.6.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.coverage.run]
diff --git a/setup.py b/setup.py
index 818acc6..077856d 100644
--- a/setup.py
+++ b/setup.py
@@ -15,7 +15,6 @@
         'Framework :: Zope :: 5',
         'License :: OSI Approved :: Zope Public License',
         'Programming Language :: Python',
-        'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
         'Programming Language :: Python :: 3.11',
@@ -26,13 +25,13 @@
     author='Zope Foundation and Contributors',
     author_email='zope-dev@zope.dev',
     url='https://github.com/zopefoundation/z3c.jbot',
-    license='ZPL 2.1',
+    license='ZPL-2.1',
     packages=find_packages('src'),
     package_dir={'': 'src'},
     namespace_packages=['z3c'],
     include_package_data=True,
     zip_safe=False,
-    python_requires='>=3.8',
+    python_requires='>=3.9',
     install_requires=[
         'setuptools',
         'zope.pagetemplate',
diff --git a/tox.ini b/tox.ini
index 086dfeb..8ccbcde 100644
--- a/tox.ini
+++ b/tox.ini
@@ -5,7 +5,6 @@ minversion = 3.18
 envlist =
     release-check
     lint
-    py38
     py39
     py310
     py311
@@ -18,7 +17,7 @@ usedevelop = true
 package = wheel
 wheel_build_env = .pkg
 deps =
-    setuptools < 74
+    setuptools <= 75.6.0
     zope.testrunner
 commands =
     zope-testrunner --test-path=src {posargs:-vc}
@@ -36,7 +35,7 @@ description = ensure that the distribution is ready to release
 basepython = python3
 skip_install = true
 deps =
-    setuptools < 74
+    setuptools <= 75.6.0
     twine
     build
     check-manifest