diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3a8c3b9..ba373f5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,7 +10,7 @@ updates:
     # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
     # current Dependabot behaviour. See rsr-template-repo commit 78b050e
     # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 3
     groups:
       cargo:
         patterns:
@@ -22,6 +22,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 2
     groups:
       actions:
         patterns:
@@ -30,15 +31,35 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "nix"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
-      interval: "weekly"
\ No newline at end of file
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0859959..11cf6c5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,10 +9,11 @@ on:
 permissions:
   actions: read
   contents: read
-
+  security-events: write
+  id-token: write
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5b1d00229e5e8c0c0fbfedc7e80f37ea50f49236
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 67b6a82..9ad08b3 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -11,6 +11,7 @@ on:
       - '.github/workflows/**'
 
 permissions: read-all
+  actions: read
 
 jobs:
   lint-workflows:
diff --git a/.mise.toml b/.mise.toml
new file mode 100644
index 0000000..3156a04
--- /dev/null
+++ b/.mise.toml
@@ -0,0 +1,2 @@
+[tools]
+rust = "stable"
diff --git a/.tool-versions b/.tool-versions
deleted file mode 100644
index 3cd07d4..0000000
--- a/.tool-versions
+++ /dev/null
@@ -1 +0,0 @@
-rust stable