diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b277bb059b..718c80f0b0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,28 +15,14 @@ repos:
         files: .*\.(yaml|yml)$
         args: ['--unsafe']
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
+    rev: v0.15.1
     hooks:
       - id: ruff-check
         args: ['--fix', '--unsafe-fixes']
       - id: ruff-format
   - repo: https://opendev.org/openstack/hacking
-    rev: 7.0.0
+    rev: 8.0.0
     hooks:
       - id: hacking
         additional_dependencies: []
         exclude: '^(doc|releasenotes)/.*$'
-  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.18.2
-    hooks:
-      - id: mypy
-        additional_dependencies:
-          - types-requests
-        # keep this in-sync with '[tool.mypy] exclude' in 'pyproject.toml'
-        exclude: |
-          (?x)(
-            doc/.*
-            | examples/.*
-            | hacking/.*
-            | releasenotes/.*
-          )
diff --git a/openstackclient/common/module.py b/openstackclient/common/module.py
index 6ca5dc2315..0985107516 100644
--- a/openstackclient/common/module.py
+++ b/openstackclient/common/module.py
@@ -61,7 +61,7 @@ class ListCommand(command.Lister):
                 # TODO(bapalm): Fix this when cliff properly supports
                 # handling the detection rather than using the hard-code below.
                 if parsed_args.formatter == 'table':
-                    command_names = utils.format_list(command_names, "\n")
+                    command_names = utils.format_list(command_names, "\n")  # type: ignore
 
                 commands.append((group, command_names))
 
diff --git a/openstackclient/identity/v2_0/service.py b/openstackclient/identity/v2_0/service.py
index 5e8dca7354..a93a953260 100644
--- a/openstackclient/identity/v2_0/service.py
+++ b/openstackclient/identity/v2_0/service.py
@@ -160,7 +160,9 @@ class ShowService(command.ShowOne):
             for service, service_endpoints in endpoints.items():
                 if service_endpoints:
                     info = {"type": service}
-                    info.update(service_endpoints[0])
+                    # FIXME(stephenfin): The return type for this in ksa is
+                    # wrong
+                    info.update(service_endpoints[0])  # type: ignore
                     return zip(*sorted(info.items()))
 
             msg = _(
diff --git a/openstackclient/volume/v2/volume_type.py b/openstackclient/volume/v2/volume_type.py
index e7b90af95a..27c7a35aad 100644
--- a/openstackclient/volume/v2/volume_type.py
+++ b/openstackclient/volume/v2/volume_type.py
@@ -466,7 +466,7 @@ class ListVolumeType(command.Lister):
             _EncryptionInfoColumn = functools.partial(
                 EncryptionInfoColumn, encryption_data=encryption
             )
-            formatters['id'] = _EncryptionInfoColumn
+            formatters['id'] = _EncryptionInfoColumn  # type: ignore
 
         return (
             column_headers,
diff --git a/openstackclient/volume/v3/volume_type.py b/openstackclient/volume/v3/volume_type.py
index fbce2f2c9a..196b356c08 100644
--- a/openstackclient/volume/v3/volume_type.py
+++ b/openstackclient/volume/v3/volume_type.py
@@ -549,7 +549,7 @@ class ListVolumeType(command.Lister):
             _EncryptionInfoColumn = functools.partial(
                 EncryptionInfoColumn, encryption_data=encryption
             )
-            formatters['id'] = _EncryptionInfoColumn
+            formatters['id'] = _EncryptionInfoColumn  # type: ignore
 
         return (
             column_headers,
diff --git a/pyproject.toml b/pyproject.toml
index 37fb8d0c26..4d72625b0e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -744,15 +744,7 @@ follow_imports = "normal"
 incremental = true
 check_untyped_defs = true
 warn_unused_ignores = true
-# keep this in-sync with 'mypy.exclude' in '.pre-commit-config.yaml'
-exclude = '''
-(?x)(
-    doc
-    | examples
-    | hacking
-    | releasenotes
-  )
-'''
+exclude = '(?x)(doc | examples | hacking | releasenotes)'
 
 [[tool.mypy.overrides]]
 module = ["openstackclient.tests.unit.*"]
diff --git a/tox.ini b/tox.ini
index 63692fe4af..6ce9e96c60 100644
--- a/tox.ini
+++ b/tox.ini
@@ -20,20 +20,22 @@ commands =
 [testenv:pep8]
 description =
   Run style checks.
-skip_install = true
 deps =
   pre-commit
+  {[testenv:mypy]deps}
 commands =
   pre-commit run --all-files --show-diff-on-failure
+  {[testenv:mypy]commands}
 
-[testenv:bandit]
+[testenv:mypy]
 description =
-  Run bandit security checks.
-skip_install = true
+  Run type checks.
 deps =
-  pre-commit
+  {[testenv]deps}
+  mypy
+  types-requests
 commands =
-  pre-commit run --all-files --show-diff-on-failure bandit
+  mypy --cache-dir="{envdir}/mypy_cache" {posargs:openstackclient}
 
 [testenv:unit-tips]
 commands =