diff --git a/.github/workflows/cibuildwheel.yml b/.github/workflows/cibuildwheel.yml
index de63734..a8c5c9c 100644
--- a/.github/workflows/cibuildwheel.yml
+++ b/.github/workflows/cibuildwheel.yml
@@ -7,9 +7,12 @@ on:
       # ** matches 'zero or more of any character'
       - 'release-v[0-9]+.[0-9]+.[0-9]+**'
       - 'prerelease-v[0-9]+.[0-9]+.[0-9]+**'
+
+permissions: {}
+
 jobs:
   build_wheels:
-    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@d0d89c035a9cd4b9b847b179c88508d7cbee965f # main
+    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@2ade48ac7d4fed55e9f24f73eddd8f280722a2f8 # main
     permissions:
       contents: write
       actions: read
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5ae07fc..7eca683 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,6 +39,8 @@ jobs:
             python_version: "3.12"
           - os: windows-latest
             python_version: "3.12"
+          - os: ubuntu-latest
+            python_version: "3.15"
           # Keep testing transformers v4. v4.57 fails to load .bin-only
           # checkpoints such as hf-internal-testing/tiny-random-xlnet (the
           # weights stay on the meta device), so test the last good series.
@@ -50,10 +52,10 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Configure Python version
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python_version }}
 
diff --git a/setup.cfg b/setup.cfg
index eeb2624..c408167 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,5 +1,5 @@
 [metadata]
-version = 2.0.2
+version = 2.0.3
 description = spaCy pipelines for pre-trained BERT and other transformers
 url = https://spacy.io
 author = Explosion
@@ -23,6 +23,7 @@ classifiers =
     Programming Language :: Python :: 3.12
     Programming Language :: Python :: 3.13
     Programming Language :: Python :: 3.14
+    Programming Language :: Python :: 3.15
 
 [options]
 zip_safe = false