diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 7bff7ff2b4..0c9db04242 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,10 +28,10 @@ repos:
   - id: cmake-format
 
 - repo: https://github.com/crate-ci/typos
-  rev: v1.16.21
+  rev: v1.28.2
   hooks:
     - id: typos
-      exclude: '^(.typos.toml|src/SmithWaterman.cc|testing/.*|auxil/.*|scripts/base/frameworks/files/magic/.*|CHANGES)$'
+      exclude: '^(.typos.toml|src/SmithWaterman.cc|testing/.*|auxil/.*|scripts/base/frameworks/files/magic/.*|CHANGES|scripts/base/protocols/ssl/mozilla-ca-list.zeek)$'
 
 - repo: https://github.com/bbannier/spicy-format
   rev: v0.20.0
diff --git a/.typos.toml b/.typos.toml
index f8a512a8c3..4d74a52e7f 100644
--- a/.typos.toml
+++ b/.typos.toml
@@ -48,6 +48,15 @@ extend-ignore-identifiers-re = [
     "ND_ROUTER_.*",
     "ND_NEIGHBOR_.*",
     ".*_ND_option.*",
+    "bck", # Used with same length as `fwd`
+    "pn", # Use for `PoolNode` variables
+    "ffrom_[ip|port|mac]", # Used in netcontrol.
+    "complte_flag", # Existing use in exported record in base.
+    "VidP(n|N)", # In SMB.
+    "iin", # In DNP3.
+    "(ScValidatePnPService|ScSendPnPMessage)", # In DCE-RPC.
+    "snet", # Used as shorthand for subnet in base scripts.
+    "(e|i)it", # Used as name for some iterators.
 ]
 
 [default.extend-identifiers]
diff --git a/NEWS b/NEWS
index 550657d6ef..142f63c9ab 100644
--- a/NEWS
+++ b/NEWS
@@ -3859,7 +3859,7 @@ Removed Functionality
 
 - Functionality for writing/reading binary event streams was
   removed. This functionality relied on the old communication code
-  anc was basically untested. The ``-R`` command-line option (replay)
+  and was basically untested. The ``-R`` command-line option (replay)
   as well as the ``capture_events`` function were removed.
 
 - Removed p0f (passive OS fingerprinting) support. The version of
diff --git a/ci/test.sh b/ci/test.sh
index ff3935579a..adea2eb292 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -41,7 +41,7 @@ function banner {
 
 function run_unit_tests {
     if [[ ${ZEEK_CI_SKIP_UNIT_TESTS} -eq 1 ]]; then
-        printf "Skipping unit tests as requested by task configureation\n\n"
+        printf "Skipping unit tests as requested by task configuration\n\n"
         return 0
     fi
 
diff --git a/scripts/policy/protocols/ssl/certificate-request-info.zeek b/scripts/policy/protocols/ssl/certificate-request-info.zeek
index 2479df5efa..c318a94615 100644
--- a/scripts/policy/protocols/ssl/certificate-request-info.zeek
+++ b/scripts/policy/protocols/ssl/certificate-request-info.zeek
@@ -6,7 +6,7 @@
 module SSL;
 
 redef record SSL::Info += {
-	## List of cient certificate CAs accepted by the server
+	## List of client certificate CAs accepted by the server
 	requested_client_certificate_authorities: vector of string &optional &log;
 };
 
diff --git a/src/analyzer/protocol/ldap/ldap.spicy b/src/analyzer/protocol/ldap/ldap.spicy
index 0816e6afe9..14c3607c56 100644
--- a/src/analyzer/protocol/ldap/ldap.spicy
+++ b/src/analyzer/protocol/ldap/ldap.spicy
@@ -935,7 +935,7 @@ type SearchFilter = unit {
   };
 
   # So when you're done with recursively parsing the filters, we can now leverage the tree structure to
-  # recursively get the stringRepresentations for those leafs, which are SearchFilters
+  # recursively get the stringRepresentations for those leaves, which are SearchFilters
 
   on %done {
     self.stringRepresentation = string_representation(self);
diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 8a056c7621..989125b90f 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -1766,7 +1766,7 @@ RecordVal* Manager::ValueToRecordVal(const Stream* stream, const Value* const* v
             // them and has been warned by reporter.
             // Hence -> assign null to the field, done.
 
-            // Better check that it really is optional. Uou never know.
+            // Better check that it really is optional. You never know.
             assert(request_type->FieldDecl(i)->GetAttr(zeek::detail::ATTR_OPTIONAL));
         }
         else if ( ! vals[*position]->present && ! request_type->FieldDecl(i)->GetAttr(zeek::detail::ATTR_OPTIONAL) ) {
diff --git a/src/script_opt/Stmt.cc b/src/script_opt/Stmt.cc
index 01c9a21e77..3e45161d7c 100644
--- a/src/script_opt/Stmt.cc
+++ b/src/script_opt/Stmt.cc
@@ -899,7 +899,7 @@ static bool simplify_chain(const std::vector<StmtPtr>& stmts, unsigned int start
 
     // An add-chain of any size is a win. For an assign-chain to be a win,
     // it needs to have at least two elements, because a single "x$a = y$b"
-    // can be expressed using one ZAM instructino (but "x$a += y$b" cannot).
+    // can be expressed using one ZAM instruction (but "x$a += y$b" cannot).
     if ( add_chains.empty() ) {
         bool have_useful_assign_chain = false;
         for ( auto& ac : assign_chains )
diff --git a/src/spicy/spicyz/driver.h b/src/spicy/spicyz/driver.h
index f6276ab0bf..a0228a4e45 100644
--- a/src/spicy/spicyz/driver.h
+++ b/src/spicy/spicyz/driver.h
@@ -146,7 +146,7 @@ public:
 
     /**
      * Parses options command-line style after Zeek-side scripts have been
-     * fully procssed. Most of the option processing happens here (vs. in
+     * fully processed. Most of the option processing happens here (vs. in
      * `parseOptionsPreScript()`) except for things that must be in place
      * already before script processing.
      *