diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml
index 65e0fab..5534e4e 100644
--- a/.pre-commit-hooks.yaml
+++ b/.pre-commit-hooks.yaml
@@ -14,7 +14,7 @@
   description: Shell source code formatter (build from source)
   language: golang
   # Note: keep Go version in `go.mod` in sync with shfmt's required Go version
-  additional_dependencies: [mvdan.cc/sh/v3/cmd/shfmt@v3.12.0]
+  additional_dependencies: [mvdan.cc/sh/v3/cmd/shfmt@v3.13.0]
   entry: shfmt
   args: [--write]
   types: [shell]
@@ -27,7 +27,7 @@
   description: Shell source code formatter (Docker image)
   language: docker_image
   # Note: use the top level multiplatform image digest here
-  entry: --net none mvdan/shfmt:v3.12.0@sha256:307d265ffd25ce832899ae17c93ed5062fc3375c514bba8f52cbf52792735c4d
+  entry: --net none mvdan/shfmt:v3.13.0@sha256:cb551dbf13a0e9a017e9c89647bcd4da3b1bd71eb16c6dc7588d2593a9b4611a
   args: [--write]
   types: [shell]
   exclude_types: [csh, tcsh, zsh]
diff --git a/README.md b/README.md
index ada955e..6946508 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ Usage in `.pre-commit-config.yaml`:
 
 ```yaml
 - repo: https://github.com/scop/pre-commit-shfmt
-  rev: v3.12.0-2
+  rev: v3.13.0-1
   hooks:
     # Choose one of:
     - id: shfmt         # prebuilt upstream executable
diff --git a/go.mod b/go.mod
index 8cca2d7..f9a1a94 100644
--- a/go.mod
+++ b/go.mod
@@ -1,3 +1,3 @@
 module github.com/scop/pre-commit-shfmt/v3
 
-go 1.23
+go 1.25.0
diff --git a/setup.cfg b/setup.cfg
index ae58a44..46fb1b7 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = shfmt_py
-version = 3.12.0-2
+version = 3.13.0-1
 description = Shell source code formatter
 url = https://github.com/scop/pre-commit-shfmt
 # shfmt proper and Python packaging related files
@@ -25,47 +25,47 @@ download_scripts =
     [shfmt]
     group = shfmt-binary
     marker = sys_platform == "darwin" and platform_machine == "x86_64"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_darwin_amd64
-    sha256 = c31548693de6584e6164b7ed5fbb7b4a083f2d937ca94b4e0ddf59aa461a85e4
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_darwin_amd64
+    sha256 = b6890a0009abf71d36d7c536ad56e3132c547ceb77cd5d5ee62b3469ab4e9417
     [shfmt]
     group = shfmt-binary
     marker = sys_platform == "darwin" and platform_machine == "arm64"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_darwin_arm64
-    sha256 = d903802e0ce3ecbc82b98512f55ba370b0d37a93f3f78de394f5b657052b33dd
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_darwin_arm64
+    sha256 = 650970603b5946dc6041836ddcfa7a19d99b5da885e4687f64575508e99cf718
     [shfmt]
     group = shfmt-binary
     # TODO: verify i386
     marker = sys_platform == "linux" and platform_machine == "i386"
     marker = sys_platform == "linux" and platform_machine == "i686"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_386
-    sha256 = 6b67da16834a215cc8c565bfbcfaa0303809456d8cafad28cb2eeea35a88904d
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_linux_386
+    sha256 = e645b59e34928442853fb5610dc485985f8acbe112a129679cede1dc320e54ff
     [shfmt]
     group = shfmt-binary
     marker = sys_platform == "linux" and platform_machine == "x86_64"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_amd64
-    sha256 = d9fbb2a9c33d13f47e7618cf362a914d029d02a6df124064fff04fd688a745ea
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_linux_amd64
+    sha256 = 70aa99784703a8d6569bbf0b1e43e1a91906a4166bf1a79de42050a6d0de7551
     [shfmt]
     group = shfmt-binary
     # TODO: verify armv6hf
     marker = sys_platform == "linux" and platform_machine == "armv6hf"
     marker = sys_platform == "linux" and platform_machine == "armv7l"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_arm
-    sha256 = a93c1ed5be25ce9dd0fd62c4cf0af7453740d234725877b973e6c6a8c7598500
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_linux_arm
+    sha256 = 774b9a86cff4844179328cfbab2f602e75dcb68132e918e5271d015b3295c9c7
     [shfmt]
     group = shfmt-binary
     marker = sys_platform == "linux" and platform_machine == "aarch64"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_linux_arm64
-    sha256 = 5f3fe3fa6a9f766e6a182ba79a94bef8afedafc57db0b1ad32b0f67fae971ba4
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_linux_arm64
+    sha256 = 2091a31afd47742051a77bf7cfd175533ab07e924c20ef3151cd108fa1cab5b0
     [shfmt.exe]
     group = shfmt-binary
     # TODO: verify both
     marker = sys_platform == "win32" and platform_machine == "x86"
     marker = sys_platform == "cygwin" and platform_machine == "i386"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_windows_386.exe
-    sha256 = 92c1ef0af344a10f2cefe3ce4bc6793ae8b3719ac08fc01802bbd8eae105e534
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_windows_386.exe
+    sha256 = f3e32b2a320a3053837add32803d7fb3b730d3f10b84a867d327a549ef068fa0
     [shfmt.exe]
     group = shfmt-binary
     marker = sys_platform == "win32" and platform_machine == "AMD64"
     marker = sys_platform == "cygwin" and platform_machine == "x86_64"
-    url = https://github.com/mvdan/sh/releases/download/v3.12.0/shfmt_v3.12.0_windows_amd64.exe
-    sha256 = c8bda517ba1c640ce4a715c0fa665439ddbe4357ba5e9b77b0e51e70e2b9c94b
+    url = https://github.com/mvdan/sh/releases/download/v3.13.0/shfmt_v3.13.0_windows_amd64.exe
+    sha256 = 62241aaf6b0ca236f8625d8892784b73fa67ad40bc677a1ad1a64ae395f6a7d5
diff --git a/tools/generate_pre_commit_hooks.py b/tools/generate_pre_commit_hooks.py
index 64379b1..e631097 100755
--- a/tools/generate_pre_commit_hooks.py
+++ b/tools/generate_pre_commit_hooks.py
@@ -13,9 +13,9 @@
   description: Shell source code formatter (prebuilt upstream executable)
   language: python
   entry: shfmt
-  args: [-w, -s]
+  args: [--write]
   types: [shell]
-  exclude_types: [csh, tcsh, zsh]
+  exclude_types: [csh, tcsh]
   stages: [pre-commit, pre-merge-commit, pre-push, manual]
   minimum_pre_commit_version: 3.2.0 # for "stages" names
 
@@ -26,9 +26,9 @@
   # Note: keep Go version in `go.mod` in sync with shfmt's required Go version
   additional_dependencies: [mvdan.cc/sh/v3/cmd/shfmt@${shfmt_tag}]
   entry: shfmt
-  args: [-w, -s]
+  args: [--write]
   types: [shell]
-  exclude_types: [csh, tcsh, zsh]
+  exclude_types: [csh, tcsh]
   stages: [pre-commit, pre-merge-commit, pre-push, manual]
   minimum_pre_commit_version: 3.2.0 # for "stages" names
 
@@ -38,9 +38,9 @@
   language: docker_image
   # Note: use the top level multiplatform image digest here
   entry: --net none mvdan/shfmt:${shfmt_tag}@${docker_image_digest}
-  args: [-w, -s]
+  args: [--write]
   types: [shell]
-  exclude_types: [csh, tcsh, zsh]
+  exclude_types: [csh, tcsh]
   stages: [pre-commit, pre-merge-commit, pre-push, manual]
   minimum_pre_commit_version: 3.2.0 # for "stages" names
 """
diff --git a/tools/generate_setup_cfg.py b/tools/generate_setup_cfg.py
index 992fef0..3322abb 100755
--- a/tools/generate_setup_cfg.py
+++ b/tools/generate_setup_cfg.py
@@ -16,11 +16,12 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
+import json
 import re
 import string
+import subprocess
 import sys
 from urllib.parse import quote as urlquote, urljoin
-from urllib.request import urlopen
 
 setup_cfg_template = """
 [metadata]
@@ -28,13 +29,10 @@
 version = ${python_pkg_version}
 description = Shell source code formatter
 url = https://github.com/scop/pre-commit-shfmt
-# license here is for shfmt proper; Python packaging related files may have others, see their contents and classifiers below
-license = BSD 3-Clause
+# shfmt proper and Python packaging related files
+license = BSD 3-Clause AND Apache Software License AND MIT License
 classifiers =
     Intended Audience :: Developers
-    License :: OSI Approved :: Apache Software License
-    License :: OSI Approved :: BSD License
-    License :: OSI Approved :: MIT License
     Operating System :: MacOS
     Operating System :: Microsoft :: Windows
     Operating System :: POSIX :: Linux
@@ -118,12 +116,10 @@ def main(python_pkg_tag: str) -> None:
     data = {
         "python_pkg_version": python_pkg_tag.lstrip("v"),
     }
-    url = urljoin(base_url, "sha256sums.txt")
-    hexdigests = {}
-    with urlopen(url) as f:
-        for line in f:
-            if m := re.search(r"^([0-9a-f]{64})\s+(\S+)$", line.decode()):
-                hexdigests[m.group(2)] = m.group(1)
+    result = subprocess.run(["gh", "release", "view", "--repo", "mvdan/sh", main_tag, "--json", "assets"], stdout=subprocess.PIPE, check=True)
+    assets = json.loads(result.stdout).get("assets", [])
+    hexdigests = {asset["name"]: asset["digest"].removeprefix("sha256:") for asset in assets if asset["digest"].startswith("sha256:")}
+
     for fn in release_files:
         if m := re.search(r"_([a-z0-9]+_[a-z0-9]+)(?:\.exe)?$", fn):
             os_arch = m.group(1)