diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9e90cd3e..ccd4083d 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -34,10 +34,8 @@ repos:
     rev: '1.9.4'
     hooks:
       - id: 'bandit'
-        args:
-          - '--severity-level=low'
-          - '--confidence-level=low'
-          - '--skip=B110,B112,B311'  # graceful-degradation patterns, non-crypto randomness
+        args: ['-c', 'pyproject.toml', '--severity-level=low', '--confidence-level=low']
+        additional_dependencies: ['bandit[toml]']
         # `plugins/modules/ipa*.py` is vendored ansible-freeipa code; bandit
         # false-positives on the project's own code style (`shell=dict(...)`
         # in argument_spec triggers B604, the literal `'on_create'` sentinel
diff --git a/pyproject.toml b/pyproject.toml
index 1035d543..25afd544 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -12,14 +12,20 @@
 # https://github.com/Linuxfabrik/lfops/issues/221) so unrelated commits
 # don't fail the hook. Drop entries from .vulture_whitelist.py as the
 # real issues are fixed.
-paths = ["plugins", ".vulture_whitelist.py"]
+paths = ['plugins', '.vulture_whitelist.py']
 min_confidence = 80
 
 [tool.pytest.ini_options]
 # Unit tests for the in-house plugins. The matrix of Python / ansible-core
 # versions is driven by tox; see tox.ini.
-testpaths = ["tests/unit"]
+testpaths = ['tests/unit']
 # importlib mode lets same-named test files live in different plugin-type
 # directories (e.g. modules/ and lookup/ both have test_bitwarden_item.py)
 # without needing __init__.py packages.
-addopts = ["--import-mode=importlib"]
+addopts = ['--import-mode=importlib']
+
+[tool.bandit]
+# B110 (try/except/pass) and B112 (try/except/continue): intentional patterns
+# for graceful degradation.
+# B311 (pseudo-random): not used for cryptographic purposes.
+skips = ['B110', 'B112', 'B311']