diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4a1bd84..1297d36 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -37,8 +37,7 @@ repos:
     rev: 1.7.9
     hooks:
       - id: bandit
-        # B104: intentional LAN listeners, B105: setup-required placeholder credentials.
-        args: ["-q", "-l", "-i", "-s", "B104,B105"]
+        args: ["-q", "-l", "-i"]
         files: ^.*\.py$
         exclude: ^tests/
 
@@ -47,7 +46,7 @@ repos:
     hooks:
       - id: pytest
         name: pytest
-        entry: python -m pytest -q
+        entry: ./scripts/precommit-pytest.sh
         language: system
         pass_filenames: false
         always_run: true
diff --git a/scripts/precommit-pytest.sh b/scripts/precommit-pytest.sh
new file mode 100755
index 0000000..888dfe9
--- /dev/null
+++ b/scripts/precommit-pytest.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Prefer the currently activated venv, then repo-local .venv, then python3/python.
+if [ -n "${VIRTUAL_ENV:-}" ] && [ -x "${VIRTUAL_ENV}/bin/python" ]; then
+  PYTHON_BIN="${VIRTUAL_ENV}/bin/python"
+elif [ -x ".venv/bin/python" ]; then
+  PYTHON_BIN=".venv/bin/python"
+elif command -v python3 >/dev/null 2>&1; then
+  PYTHON_BIN="python3"
+elif command -v python >/dev/null 2>&1; then
+  PYTHON_BIN="python"
+else
+  echo "No Python interpreter found for pytest hook." >&2
+  exit 1
+fi
+
+exec "${PYTHON_BIN}" -m pytest -q
\ No newline at end of file