diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3344f966d8..dd87712692 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,7 +1,7 @@
 ---
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       # whitespace
       - id: trailing-whitespace
@@ -59,7 +59,7 @@ repos:
         args: ['--ignore-words=doc/dictionary.txt']
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.15.0
+    rev: v1.18.2
     hooks:
       - id: mypy
         additional_dependencies:
@@ -94,7 +94,7 @@ repos:
           )
 
   - repo: https://github.com/sphinx-contrib/sphinx-lint
-    rev: v1.0.0
+    rev: v1.0.1
     hooks:
       - id: sphinx-lint
         args: [--enable=default-role]
diff --git a/nova/crypto.py b/nova/crypto.py
index 44aeef2fa9..804fa46872 100644
--- a/nova/crypto.py
+++ b/nova/crypto.py
@@ -171,7 +171,7 @@ def _create_x509_openssl_config(conffile: str, upn: str):
 def ensure_vtpm_secret(
     context: nova_context.RequestContext,
     instance: 'objects.Instance',
-) -> ty.Tuple[str, str]:
+) -> ty.Tuple[str, bytes]:
     """Communicates with the key manager service to retrieve or create a secret
     for an instance's emulated TPM.