diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5b1b32f..fa7ddb4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,3 +5,5 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d974650..0539e2d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,15 +5,17 @@ on:
     branches:
       - master
   pull_request:
-  schedule:
-    - cron: '0 12 * * *'
+
+permissions: {}
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.5.3
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ">= 3.9"
       - name: lint
@@ -29,10 +31,11 @@ jobs:
           - "3.10"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.5.3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
-      - uses: actions/setup-python@v4
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
       - name: deps
diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml
index 07ec022..49ffc2d 100644
--- a/.github/workflows/pip-audit.yml
+++ b/.github/workflows/pip-audit.yml
@@ -8,16 +8,20 @@ on:
   schedule:
     - cron: "0 12 * * *"
 
+permissions: {}
+
 jobs:
   pip-audit:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3.5.3
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ">= 3.9"
 
@@ -30,7 +34,7 @@ jobs:
 
 
       - name: Run pip-audit
-        uses: pypa/gh-action-pip-audit@v1.0.8
+        uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
         with:
           virtual-environment: /tmp/pip-audit-env
 
diff --git a/.github/workflows/pythonpublish.yml b/.github/workflows/pythonpublish.yml
deleted file mode 100644
index 679b38d..0000000
--- a/.github/workflows/pythonpublish.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-# This workflows will upload a Python Package using Twine when a release is created
-# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
-
-name: Upload Python Package
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  deploy:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v3.5.3
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '>= 3.9'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install setuptools wheel twine
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python setup.py sdist bdist_wheel
-        twine upload dist/*
diff --git a/protofuzz/tests/test_pbimport.py b/protofuzz/tests/test_pbimport.py
index e358ad6..fbbad00 100644
--- a/protofuzz/tests/test_pbimport.py
+++ b/protofuzz/tests/test_pbimport.py
@@ -88,12 +88,13 @@ def test_generate_and_import(self):
         Test generation and loading of protobuf artifacts
         """
         name = f"Msg{secrets.token_hex(16)}"
+        filename = os.path.join(self.tempdir, f"{name}.proto")
         contents = "message {} {{ required int32 var = 1; }}\n".format(name)
 
-        with open(self.valid_filename, "w") as f:
+        with open(filename, "w") as f:
             f.write(contents)
 
-        module = pbimport.from_file(self.valid_filename)
+        module = pbimport.from_file(filename)
         self.assertTrue(hasattr(module, name))
 
     def test_failing_generate_and_import(self):
diff --git a/protofuzz/tests/test_protofuzz.py b/protofuzz/tests/test_protofuzz.py
index 2c9b9ff..fac372e 100644
--- a/protofuzz/tests/test_protofuzz.py
+++ b/protofuzz/tests/test_protofuzz.py
@@ -107,9 +107,7 @@ def test_enum(self):
             enum Colors {{ RED = {}; GREEN = {}; BLUE = {}; }}
             required Colors color = 1;
         }}
-        """.format(
-            *enum_values
-        )
+        """.format(*enum_values)
 
         messages = protofuzz.from_description_string(definition)
 
@@ -125,9 +123,7 @@ def test_floating_point(self):
             message {} {{
                 required double dbl = 1;
                 required float fl = 2;
-            }}""".format(
-            name
-        )
+            }}""".format(name)
         messages = protofuzz.from_description_string(definition)
         for msg in messages[name].linear():
             self.assertIsInstance(msg.dbl, float)
@@ -138,9 +134,7 @@ def _single_field_helper(self, field_type, field_name):
         definition = """
             message {} {{
                 required {} {} = 1;
-            }}""".format(
-            name, field_type, field_name
-        )
+            }}""".format(name, field_type, field_name)
         permuter = protofuzz.from_description_string(definition)[name]
         return permuter.linear(limit=10)
 
@@ -163,9 +157,7 @@ def test_repeated_msg(self):
         definition = """
             message Inner {{ required int32 val = 1; }}
             message {} {{ repeated Inner val = 1; }}
-        """.format(
-            name
-        )
+        """.format(name)
 
         messages = protofuzz.from_description_string(definition)