diff --git a/{{ cookiecutter.package_name }}/.github/workflows/release.yml b/{{ cookiecutter.package_name }}/.github/workflows/release.yml
index 071c41d..9316cd1 100644
--- a/{{ cookiecutter.package_name }}/.github/workflows/release.yml	
+++ b/{{ cookiecutter.package_name }}/.github/workflows/release.yml	
@@ -8,15 +8,15 @@ on:
 
 jobs:
   build-and-publish:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Poetry
         run: pipx install poetry
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.9
       - name: Verify versioning
         run: |
           [ "$(poetry version -s)" == "${GITHUB_REF#refs/tags/v}" ]
diff --git a/{{ cookiecutter.package_name }}/.github/workflows/test.yml b/{{ cookiecutter.package_name }}/.github/workflows/test.yml
index c703506..2debab6 100644
--- a/{{ cookiecutter.package_name }}/.github/workflows/test.yml	
+++ b/{{ cookiecutter.package_name }}/.github/workflows/test.yml	
@@ -10,15 +10,15 @@ jobs:
   test:
     strategy:
       matrix:
-        os: [ 'ubuntu-20.04' ]
-        python-version: [ '3.8', '3.9', '3.10', '3.11' ]
+        os: ["ubuntu-24.04", "windows-2022", "macos-14"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
     runs-on: {{ '${{ matrix.os }}' }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Install Poetry
         run: pipx install poetry
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: {{ '${{ matrix.python-version }}' }}
       - name: Install dependencies
@@ -30,7 +30,7 @@ jobs:
         run: poetry run python print-coverage.py >> $GITHUB_ENV
       - name: Create coverage badge
         if: {{ '${{' }} github.repository == '{{ cookiecutter.github_account }}/{{ cookiecutter.package_name }}' && github.event_name == 'push' && runner.os == 'Linux' }}
-        uses: schneegans/dynamic-badges-action@v1.1.0
+        uses: schneegans/dynamic-badges-action@1.7.0
         with:
           auth: {{ '${{ secrets.GIST_SECRET }}' }}
           gistID: {{ cookiecutter.coverage_gist }}
diff --git a/{{ cookiecutter.package_name }}/print-coverage.py b/{{ cookiecutter.package_name }}/print-coverage.py
index 65667a0..503adfe 100644
--- a/{{ cookiecutter.package_name }}/print-coverage.py	
+++ b/{{ cookiecutter.package_name }}/print-coverage.py	
@@ -1,7 +1,7 @@
 # Prints code testing coverage as percentage for badge generation.
-import xml.etree.ElementTree as et
+from defusedxml.ElementTree import parse
 
-tree = et.parse("cov.xml")
+tree = parse("cov.xml")
 root = tree.getroot()
 coverage = float(root.attrib["line-rate"]) * 100
 print(f"COVERAGE={coverage:3.4}%")
diff --git a/{{ cookiecutter.package_name }}/pyproject.toml b/{{ cookiecutter.package_name }}/pyproject.toml
index 0bc7884..a0cae05 100644
--- a/{{ cookiecutter.package_name }}/pyproject.toml	
+++ b/{{ cookiecutter.package_name }}/pyproject.toml	
@@ -10,10 +10,11 @@ packages = [
 ]
 
 [tool.poetry.dependencies]
-python = "^3.8"
+python = "^3.9"
 
 [tool.poetry.dev-dependencies]
+defusedxml = "^0.7"
 
 [build-system]
-requires = ["poetry-core>=1.0.0"]
+requires = ["poetry-core>=1.8.1"]
 build-backend = "poetry.core.masonry.api"