diff --git a/.copier-answers.yml b/.copier-answers.yml
index b3b5a2c0..5bdb62a8 100644
--- a/.copier-answers.yml
+++ b/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Do NOT update manually; changes here will be overwritten by Copier
-_commit: 95203e6
+_commit: 8677dea
 _src_path: https://github.com/ingadhoc/addons-repo-template.git
 description: ADHOC Odoo Multi Store Related Addons
 is_private: false
diff --git a/.github/instructions/models.instructions.md b/.github/instructions/models.instructions.md
index 7de0ac75..af275930 100644
--- a/.github/instructions/models.instructions.md
+++ b/.github/instructions/models.instructions.md
@@ -50,7 +50,7 @@ applyTo:
 
 ## Nombres y estilo
 
-- Métodos privados prefijo `_`; en Odoo 19, preferir `@api.private` donde aplica.
+- Métodos privados prefijo `_` (sigue siendo la convención estándar; ya bloquea RPC por sí solo). `@api.private` **no** es un reemplazo del prefijo: es para el caso de excepción de un método sin `_` (API pública existente, o método interno del ORM) que necesita bloquearse de RPC sin renombrarlo. Ver docstring de `private` en `odoo/orm/decorators.py`.
 - Métodos muy largos (>50 líneas) → sugerir split.
 - Comparaciones booleanas: `if x:` / `if not x:` (no `== True` / `== False`).
 - `else` después de `return` innecesario.
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index baa05dbf..a4f0356c 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -18,28 +18,46 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
+      -
+        name: Block sensitive file changes from fork PRs
+        if: >-
+          github.event_name == 'pull_request_target' &&
+          github.event.pull_request.head.repo.full_name != github.repository
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          changed=$(gh api --paginate \
+            "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" \
+            --jq '.[].filename')
+          if echo "$changed" | grep -qE '^(\.github/workflows/|\.pre-commit-config\.yaml$)'; then
+            echo "::error::Fork PRs may not modify workflows or the pre-commit config. Blocked for security."
+            exit 1
+          fi
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.ref }}
+          allow-unsafe-pr-checkout: true
       -
         id: setup-python
         name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.10"
           cache: "pip"
       -
         name: Pre-commit cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ steps.setup-python.outputs.python-version }}|${{ hashFiles('.pre-commit-config.yaml') }}
       -
         id: precommit
         name: Pre-commit
-        uses: pre-commit/action@v3.0.1
+        run: |
+          pip install pre-commit
+          pre-commit run --all-files --show-diff-on-failure --color=always
       -
         name: Create commit status
         if: github.event_name == 'pull_request_target'