diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml
index 6416ae6..59a9f9c 100644
--- a/.github/workflows/conda.yml
+++ b/.github/workflows/conda.yml
@@ -13,7 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         platform: [ubuntu-latest, macos-12, windows-2019]
-        python-version: ["3.8", "3.11"]
+        python-version: ["3.9", "3.11"]
 
     runs-on: ${{ matrix.platform }}
 
diff --git a/.github/workflows/pip.yml b/.github/workflows/pip.yml
index 3a5af45..c16fd69 100644
--- a/.github/workflows/pip.yml
+++ b/.github/workflows/pip.yml
@@ -14,8 +14,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        platform: [windows-latest, macos-13, ubuntu-latest]
-        python-version: ["3.7", "3.12", "pypy-3.9"]
+        platform: [windows-latest, macos-latest, ubuntu-latest]
+        python-version: ["3.9", "3.13", "pypy-3.10"]
 
     steps:
     - uses: actions/checkout@v4
@@ -23,6 +23,7 @@ jobs:
     - uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        allow-prereleases: true
 
     - name: Build and install
       run: pip install --verbose .[test]
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index e6d7b95..669d1b7 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -44,14 +44,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-13, macos-14, windows-latest]
+        os: [ubuntu-latest, macos-13, macos-latest, windows-latest]
 
     steps:
     - uses: actions/checkout@v4
       with:
         submodules: true
 
-    - uses: yezz123/setup-uv@v4
+    - uses: astral-sh/setup-uv@v3
 
     - uses: pypa/cibuildwheel@v2.21
       env:
@@ -76,6 +76,7 @@ jobs:
     environment: pypi
     permissions:
       id-token: write
+      attestations: write
 
     steps:
     - uses: actions/setup-python@v5
@@ -88,4 +89,11 @@ jobs:
         merge-multiple: true
         path: dist
 
+    - name: Generate artifact attestation for sdist and wheels
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: "dist/*"
+
     - uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        attestations: true
diff --git a/README.md b/README.md
index 5a51b65..5d89f44 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
 
 
 An example project built with [pybind11][] and [scikit-build-core][]. Python
-3.7+ (see older commits for older versions of Python using [scikit-build (classic)][]).
+3.9+ (see older commits for 3.7+, or even older versions of Python using [scikit-build (classic)][]).
 
 
 [gitter-badge]:            https://badges.gitter.im/pybind/Lobby.svg
diff --git a/pyproject.toml b/pyproject.toml
index b657b6c..106ce08 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["scikit-build-core>=0.3.3", "pybind11"]
+requires = ["scikit-build-core>=0.10", "pybind11"]
 build-backend = "scikit_build_core.build"
 
 
@@ -11,7 +11,7 @@ readme = "README.md"
 authors = [
   { name = "My Name", email = "me@email.com" },
 ]
-requires-python = ">=3.7"
+requires-python = ">=3.9"
 classifiers = [
   "Development Status :: 4 - Beta",
   "License :: OSI Approved :: MIT License",
@@ -22,6 +22,7 @@ classifiers = [
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
 ]
 
 [project.optional-dependencies]
@@ -30,10 +31,11 @@ test = ["pytest"]
 
 [tool.scikit-build]
 wheel.expand-macos-universal-tags = true
+minimum-version = "build-system.requires"
 
 
 [tool.pytest.ini_options]
-minversion = "6.0"
+minversion = "8.0"
 addopts = ["-ra", "--showlocals", "--strict-markers", "--strict-config"]
 xfail_strict = true
 log_cli_level = "INFO"
@@ -50,13 +52,8 @@ test-command = "pytest {project}/tests"
 test-extras = ["test"]
 
 [tool.cibuildwheel.pyodide]
-environment.CFLAGS = "-fexceptions"
-environment.LDFLAGS = "-fexceptions"
 build-frontend = {name = "build", args = ["--exports", "whole_archive"]}
 
-[tool.ruff]
-src = ["src"]
-
 [tool.ruff.lint]
 extend-select = [
   "B",           # flake8-bugbear