diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..618d0eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+
+# GitHub Actions only. Python dependencies are governed by pyproject's own
+# bounds and the bounds-check matrix, which Dependabot cannot reason about.
+#
+# pypa/gh-action-pypi-publish v1.14.2 shipped 13 days before hatchling 1.32.0
+# raised the default core-metadata version to 2.5. A weekly bump would have
+# landed the new uploader inside that window. Dependabot also writes the
+# peeled commit sha, not the annotated tag object.
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: ci
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ea7b4e..d1a4b04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -175,6 +175,11 @@ jobs:
         run: uv python install 3.13
       - name: Build distributions
         run: uv build
+      # Keep this twine version equal to the one release.yml's pinned
+      # pypa/gh-action-pypi-publish ships, or publish can reject a build CI
+      # accepted. Both move together.
+      - name: twine check (same twine the publish action runs)
+        run: uv run --with twine==7.0.0 twine check dist/*
       - name: Upload distribution artifacts
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5d859a..1c2ae61 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -125,7 +125,7 @@ jobs:
       # Trusted Publisher must be configured on pypi.org for this repo +
       # workflow + environment (one-time manual step — see RELEASE.md).
       # No password/token input: the action exchanges the OIDC token.
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist
 
diff --git a/pyproject.toml b/pyproject.toml
index 664dc2d..bf8d5ac 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -23,7 +23,7 @@ Repository = "https://github.com/convertcom/python-sdk"
 Changelog = "https://github.com/convertcom/python-sdk/releases"
 
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling<2"]
 build-backend = "hatchling.build"
 
 # Single-source the version from src/convert_sdk/version.py (qs-01). The