diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..e1cafccb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      cargo-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: npm
+    directory: /client
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4f54eb0d..a764b584 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,20 +1,27 @@
 name: Build
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
 permissions:
   contents: read
 
 jobs:
   build-linux:
     name: Linux
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Rust Cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/bin/
@@ -30,14 +37,14 @@ jobs:
         sudo apt install -y lld autogen libasound2-dev pkg-config make libssl-dev gcc g++ curl wget git libwebkit2gtk-4.1-dev
 
     - name: Install NodeJS
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
 
     - name: Install pnpm
-      uses: pnpm/action-setup@v2
+      uses: pnpm/action-setup@v4
       with:
-        version: 8
+        version: 10
 
     - name: Build
       run: |
@@ -45,7 +52,6 @@ jobs:
         pnpm i
         pnpm run build
         cd ..
-        cargo update
         cargo build --release
 
     - name: Bundle
@@ -55,13 +61,13 @@ jobs:
         mkdir dist
         mv OneTagger-linux.tar.gz dist/
         mv OneTagger-linux-cli.tar.gz dist/
-    
+
     - name: Upload Linux
       uses: actions/upload-artifact@v4
       with:
         name: onetagger-linux
         path: dist/OneTagger-linux.tar.gz
-    
+
     - name: Upload Linux CLI
       uses: actions/upload-artifact@v4
       with:
@@ -72,13 +78,13 @@ jobs:
   build-win:
     name: Windows
     runs-on: windows-2022
-    
+
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Rust Cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/bin/
@@ -89,14 +95,14 @@ jobs:
         key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
     - name: Install NodeJS
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
 
     - name: Install pnpm
-      uses: pnpm/action-setup@v2
+      uses: pnpm/action-setup@v4
       with:
-        version: 8
+        version: 10
 
     - name: Install Dependencies
       run: |
@@ -109,9 +115,8 @@ jobs:
         pnpm i
         pnpm run build
         cd ..
-        cargo update
         cargo build --release
-        
+
     - name: Bundle
       run: |
         mkdir dist
@@ -125,9 +130,9 @@ jobs:
       uses: actions/upload-artifact@v4
       with:
         name: onetagger-win
-        path: | 
+        path: |
           dist/OneTagger-windows.exe
-    
+
     - name: Upload Archive
       uses: actions/upload-artifact@v4
       with:
@@ -143,15 +148,15 @@ jobs:
 
   build-mac:
     name: Mac
-    runs-on: macos-13
+    runs-on: macos-14
 
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Rust Cache
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |
           ~/.cargo/bin/
@@ -161,19 +166,29 @@ jobs:
           target/
         key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
 
+    - name: Install NodeJS
+      uses: actions/setup-node@v4
+      with:
+        node-version: 22
+
+    - name: Install pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: 10
+
     - name: Install dependencies
       run: |
-        brew install rustup nodejs pnpm
-        rustup install stable
+        # macos-14 (Apple Silicon) runners come with rustc + cargo preinstalled,
+        # so we don't need `brew install rustup` (which no longer configures PATH
+        # the way it used to and was shadowing the preinstalled toolchain).
         cargo install cargo-bundle --version 0.6.1 --locked || true
-    
+
     - name: Build
       run: |
         cd client
         pnpm i
         pnpm run build
         cd ..
-        cargo update
         cargo build --release
         cargo bundle --release
 
@@ -206,3 +221,34 @@ jobs:
         name: onetagger-mac-cli
         path: dist/OneTagger-mac-cli.zip
 
+
+  release:
+    name: Publish release
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build-linux, build-win, build-mac]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+
+      - name: Create release and upload assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Flatten one level: dist/<artifact-name>/<file> → dist/<file>
+          shopt -s nullglob
+          for d in dist/*/; do
+            mv "$d"* dist/ 2>/dev/null || true
+            rmdir "$d" 2>/dev/null || true
+          done
+          gh release create "$TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --title "$TAG" \
+            --generate-notes \
+            dist/*