diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index f29bd265..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,93 +0,0 @@
----
-version: 2.1
-
-executors:
-  python:
-    docker:
-      - image: cimg/python:3.9
-
-jobs:
-  flake8_lint:
-    executor: python
-    steps:
-      - checkout
-      - run: pip install tox
-      - run: tox -e flake8
-  isort_lint:
-    executor: python
-    steps:
-      - checkout
-      - run: pip install tox
-      - run: tox -e isort
-  mypy_lint:
-    executor: python
-    steps:
-      - checkout
-      - run: pip install tox
-      - run: tox -e mypy
-  test:
-    parameters:
-      python:
-        type: string
-    docker:
-      - image: cimg/python:<< parameters.python >>
-    environment:
-      TOXENV: "py<< parameters.python >>"
-    steps:
-      - checkout
-      - run: echo 'export PATH=$HOME/.local/bin:$PATH' >> $BASH_ENV
-      - run: pip install --user tox "virtualenv<20.22.0"
-      - run: tox
-  test_nooptionals:
-    parameters:
-      python:
-        type: string
-    docker:
-      - image: cimg/python:<< parameters.python >>
-    environment:
-      TOXENV: "py<< parameters.python >>-nooptionals"
-    steps:
-      - checkout
-      - run: pip install tox
-      - run: tox
-  test_pypy:
-    parameters:
-      python:
-        type: string
-    docker:
-      - image: pypy:<< parameters.python >>
-    environment:
-      TOXENV: "pypy<< parameters.python >>"
-    steps:
-      - checkout
-      - run: pip install tox
-      - run: tox
-   
-
-workflows:
-  version: 2
-  client_python:
-    jobs:
-      - flake8_lint
-      - isort_lint
-      - mypy_lint
-      - test:
-          matrix:
-            parameters:
-               python:
-                 - "3.9.18"
-                 - "3.10"
-                 - "3.11"
-                 - "3.12"
-                 - "3.13"
-                 - "3.14"
-      - test_nooptionals:
-          matrix:
-            parameters:
-               python:
-                 - "3.9"
-      - test_pypy:
-          matrix:
-            parameters:
-               python:
-                 - "3.9"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 00000000..a7e4e094
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,110 @@
+name: CI
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  flake8_lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.9'
+      - name: Install tox
+        run: pip install tox
+      - name: Run flake8
+        run: tox -e flake8
+
+  isort_lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.9'
+      - name: Install tox
+        run: pip install tox
+      - name: Run isort
+        run: tox -e isort
+
+  mypy_lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.9'
+      - name: Install tox
+        run: pip install tox
+      - name: Run mypy
+        run: tox -e mypy
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: |
+          pip install --user tox "virtualenv<20.22.0"
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+      - name: Set tox environment
+        id: toxenv
+        run: |
+          VERSION="${{ matrix.python-version }}"
+          # Extract major.minor version (strip patch if present)
+          TOX_VERSION=$(echo "$VERSION" | cut -d. -f1,2)
+          echo "toxenv=py${TOX_VERSION}" >> $GITHUB_OUTPUT
+      - name: Run tests
+        run: tox
+        env:
+          TOXENV: ${{ steps.toxenv.outputs.toxenv }}
+
+  test_nooptionals:
+    runs-on: ubuntu-latest
+    env:
+      PYTHON_VERSION: '3.9'
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up Python
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install tox
+        run: pip install tox
+      - name: Run tests without optional dependencies
+        run: tox
+        env:
+          TOXENV: py${{ env.PYTHON_VERSION }}-nooptionals
+
+  test_pypy:
+    runs-on: ubuntu-latest
+    env:
+      PYTHON_VERSION: '3.9'
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - name: Set up PyPy
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: pypy-${{ env.PYTHON_VERSION }}
+      - name: Install tox
+        run: pip install tox
+      - name: Run tests with PyPy
+        run: tox
+        env:
+          TOXENV: pypy${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/github-pages.yaml b/.github/workflows/github-pages.yaml
index 621f2d73..d8db8cbc 100644
--- a/.github/workflows/github-pages.yaml
+++ b/.github/workflows/github-pages.yaml
@@ -11,9 +11,6 @@ on:
 # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
-  pages: write
-  id-token: write
-  actions: read
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@@ -32,6 +29,9 @@ jobs:
     runs-on: ubuntu-latest
     env:
       HUGO_VERSION: 0.145.0
+    permissions:
+      pages: write
+      id-token: write
     steps:
       - name: Install Hugo CLI
         run: |
@@ -40,13 +40,13 @@ jobs:
       #- name: Install Dart Sass
       #  run: sudo snap install dart-sass
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           submodules: recursive
           fetch-depth: 0
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
       - name: Install Node.js dependencies
         run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true"
         working-directory: ./docs
@@ -62,7 +62,7 @@ jobs:
             --baseURL "${{ steps.pages.outputs.base_url }}/"
         working-directory: ./docs
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: ./docs/public
 
@@ -73,7 +73,11 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      pages: write
+      id-token: write
+      actions: read
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5