diff --git a/.github/workflows/bench-iso.yml b/.github/workflows/bench-iso.yml
index c2692e080..672dabe71 100644
--- a/.github/workflows/bench-iso.yml
+++ b/.github/workflows/bench-iso.yml
@@ -8,12 +8,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # tags needed for dynamic versioning
           fetch-depth: 0
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
@@ -39,7 +39,7 @@ jobs:
         run: |
           poe bench-iso
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage.xml
           flags: isobench
diff --git a/.github/workflows/bench-lha-rust.yml b/.github/workflows/bench-lha-rust.yml
index ac0b9ceaa..fd85db216 100644
--- a/.github/workflows/bench-lha-rust.yml
+++ b/.github/workflows/bench-lha-rust.yml
@@ -24,10 +24,10 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up Python ${{ matrix.python-version }} 🐍
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install and configure Poetry
diff --git a/.github/workflows/bench-lha.yml b/.github/workflows/bench-lha.yml
index 7729c02de..7b89a1e78 100644
--- a/.github/workflows/bench-lha.yml
+++ b/.github/workflows/bench-lha.yml
@@ -19,12 +19,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # tags needed for dynamic versioning
           fetch-depth: 0
       - name: Install Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
diff --git a/.github/workflows/msrv.yml b/.github/workflows/msrv.yml
index 0e0825ee5..8cbf34975 100644
--- a/.github/workflows/msrv.yml
+++ b/.github/workflows/msrv.yml
@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Run check
         run: |
           # extract the MSRV
diff --git a/.github/workflows/python-poetry-tests-with-data.yml b/.github/workflows/python-poetry-tests-with-data.yml
index 29f38423a..958a1515e 100644
--- a/.github/workflows/python-poetry-tests-with-data.yml
+++ b/.github/workflows/python-poetry-tests-with-data.yml
@@ -41,13 +41,13 @@ jobs:
     container: ${{ inputs.container-image }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           # tags needed for dynamic versioning
           fetch-depth: 0
       - name: Set up Python ${{ inputs.python-version }} 🐍
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
       - name: Install and configure Poetry
@@ -56,7 +56,7 @@ jobs:
           virtualenvs-path: ~/.virtualenvs
           installer-parallel: true
       - name: Cache Poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         id: cache
         with:
           path: ~/.virtualenvs
@@ -77,7 +77,7 @@ jobs:
         run: pip install poethepoet
       - name: Get test data
         id: cache-test-data
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: test-data
           key: test-data-${{inputs.data-version}}
@@ -95,7 +95,7 @@ jobs:
         run: |
           poe test
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage.xml
           flags: unittests
diff --git a/.github/workflows/release-capi.yml b/.github/workflows/release-capi.yml
index 822664549..d3da1a046 100644
--- a/.github/workflows/release-capi.yml
+++ b/.github/workflows/release-capi.yml
@@ -11,7 +11,8 @@ on:
         description: >-
           Existing release tag to (re)publish. Use this to complete a release
           whose tag-triggered run failed partway.
-        required: false
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -20,18 +21,47 @@ jobs:
   set-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          fetch-depth: 0
+      - name: Validate tag
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::Tag must be specified."
+            exit 1
+          fi
+          if [[ ! "$TAG" =~ ^v?[0-9]+(\.[0-9]+)*(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid tag format: $TAG"
+            exit 1
+          fi
+          if [ "$IS_DISPATCH" = "true" ]; then
+            if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag '$TAG' does not exist in the repository."
+              exit 1
+            fi
+          fi
+      - name: Check if already published
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/${{ github.repository }}/releases/tags/${TAG}")
+          if [ "$STATUS" = "200" ]; then
+            echo "::error::GitHub Release for tag '$TAG' is already published."
+            exit 1
+          fi
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         uses: snok/install-poetry@v1
       - name: Install task runner
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         run: pip install poethepoet
       - name: Bump versions
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         env:
           TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
@@ -62,7 +92,9 @@ jobs:
           - name: macos-aarch64
             runner: macos-14
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
@@ -109,7 +141,7 @@ jobs:
         working-directory: dist-artifacts
         run: sha256sum *.tar.gz > SHA256SUMS.txt
       - name: Publish to GitHub Releases
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: |
diff --git a/.github/workflows/release-crates.yml b/.github/workflows/release-crates.yml
index 2f692b488..363b6df9a 100644
--- a/.github/workflows/release-crates.yml
+++ b/.github/workflows/release-crates.yml
@@ -11,7 +11,8 @@ on:
         description: >-
           Existing release tag to (re)publish. Use this to complete a release
           whose tag-triggered run failed partway.
-        required: false
+        required: true
+        type: string
 
 jobs:
   deploy:
@@ -19,8 +20,49 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          fetch-depth: 0
+      - name: Validate tag
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::Tag must be specified."
+            exit 1
+          fi
+          if [[ ! "$TAG" =~ ^v?[0-9]+(\.[0-9]+)*(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid tag format: $TAG"
+            exit 1
+          fi
+          if [ "$IS_DISPATCH" = "true" ]; then
+            if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag '$TAG' does not exist in the repository."
+              exit 1
+            fi
+          fi
+      - name: Check if already published
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          ALL_PUBLISHED=true
+          for crate in $(jq -r '.[]' crates/release.json); do
+            STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "User-Agent: eko-release-ci" "https://crates.io/api/v1/crates/${crate}/${VERSION}")
+            if [ "$STATUS" != "200" ]; then
+              ALL_PUBLISHED=false
+              break
+            fi
+          done
+          if [ "$ALL_PUBLISHED" = "true" ]; then
+            echo "::error::All crates for version '$VERSION' are already published on crates.io."
+            exit 1
+          fi
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
         uses: snok/install-poetry@v1
       - name: Install task runner
diff --git a/.github/workflows/release-ekors.yml b/.github/workflows/release-ekors.yml
index ae6c97609..46cd01ead 100644
--- a/.github/workflows/release-ekors.yml
+++ b/.github/workflows/release-ekors.yml
@@ -1,4 +1,4 @@
-name: Deploy Maturin wheels
+name: Deploy Maturin wheels (eko-rs)
 
 on:
   push:
@@ -11,7 +11,8 @@ on:
         description: >-
           Existing release tag to (re)publish. Use this to complete a release
           whose tag-triggered run failed partway.
-        required: false
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -21,18 +22,47 @@ jobs:
   set-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          fetch-depth: 0
+      - name: Validate tag
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::Tag must be specified."
+            exit 1
+          fi
+          if [[ ! "$TAG" =~ ^v?[0-9]+(\.[0-9]+)*(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid tag format: $TAG"
+            exit 1
+          fi
+          if [ "$IS_DISPATCH" = "true" ]; then
+            if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag '$TAG' does not exist in the repository."
+              exit 1
+            fi
+          fi
+      - name: Check if already published
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/eko-rs/${VERSION}/json")
+          if [ "$STATUS" = "200" ]; then
+            echo "::error::eko-rs version '$VERSION' is already published on PyPI."
+            exit 1
+          fi
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         uses: snok/install-poetry@v1
       - name: Install task runner
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         run: pip install poethepoet
       - name: Bump versions
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         env:
           TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
@@ -59,7 +89,9 @@ jobs:
           - runner: ubuntu-latest
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
@@ -70,7 +102,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-multilib
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Build wheels
@@ -97,13 +129,15 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
           name: patched-cargo
           path: .
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
           architecture: ${{ matrix.platform.target }}
@@ -130,13 +164,15 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
           name: patched-cargo
           path: .
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Build wheels
@@ -155,7 +191,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [set-version]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
diff --git a/.github/workflows/release-pyapi.yml b/.github/workflows/release-pyapi.yml
index e5fae7cb1..c3fa75f79 100644
--- a/.github/workflows/release-pyapi.yml
+++ b/.github/workflows/release-pyapi.yml
@@ -1,4 +1,4 @@
-name: Deploy Maturin wheels
+name: Deploy Maturin wheels (ekore-rs)
 
 on:
   push:
@@ -11,7 +11,8 @@ on:
         description: >-
           Existing release tag to (re)publish. Use this to complete a release
           whose tag-triggered run failed partway.
-        required: false
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -21,18 +22,47 @@ jobs:
   set-version:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          fetch-depth: 0
+      - name: Validate tag
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::Tag must be specified."
+            exit 1
+          fi
+          if [[ ! "$TAG" =~ ^v?[0-9]+(\.[0-9]+)*(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid tag format: $TAG"
+            exit 1
+          fi
+          if [ "$IS_DISPATCH" = "true" ]; then
+            if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag '$TAG' does not exist in the repository."
+              exit 1
+            fi
+          fi
+      - name: Check if already published
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/ekore-rs/${VERSION}/json")
+          if [ "$STATUS" = "200" ]; then
+            echo "::error::ekore-rs version '$VERSION' is already published on PyPI."
+            exit 1
+          fi
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         uses: snok/install-poetry@v1
       - name: Install task runner
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         run: pip install poethepoet
       - name: Bump versions
-        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
         env:
           TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
@@ -59,7 +89,9 @@ jobs:
           - runner: ubuntu-latest
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
@@ -70,7 +102,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y gcc-multilib
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install Rust
@@ -99,13 +131,15 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
           name: patched-cargo
           path: .
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
           architecture: ${{ matrix.platform.target }}
@@ -134,13 +168,15 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
           name: patched-cargo
           path: .
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install Rust
@@ -161,7 +197,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [set-version]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
       - name: Download patched Cargo files
         uses: actions/download-artifact@v4
         with:
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index 16a9f1c1c..2808f7d6c 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -1,4 +1,4 @@
-name: deploy
+name: Deploy Python package
 
 on:
   push:
@@ -11,7 +11,8 @@ on:
         description: >-
           Existing release tag to (re)publish. Use this to complete a release
           whose tag-triggered run failed partway.
-        required: false
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -26,13 +27,50 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
           # tags needed for dynamic versioning
           fetch-depth: 0
+      - name: Validate tag
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+          IS_DISPATCH: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          if [ -z "$TAG" ]; then
+            echo "::error::Tag must be specified."
+            exit 1
+          fi
+          if [[ ! "$TAG" =~ ^v?[0-9]+(\.[0-9]+)*(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid tag format: $TAG"
+            exit 1
+          fi
+          if [ "$IS_DISPATCH" = "true" ]; then
+            if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag '$TAG' does not exist in the repository."
+              exit 1
+            fi
+          fi
+      - name: Check if already published
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/eko/${VERSION}/json")
+          if [ "$STATUS" = "200" ]; then
+            echo "::error::eko version '$VERSION' is already published on PyPI."
+            exit 1
+          fi
+      - name: Set release version
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          # Strip leading 'v' if present
+          VERSION="${TAG#v}"
+          echo "POETRY_DYNAMIC_VERSIONING_BYPASS=${VERSION}" >> "$GITHUB_ENV"
       - name: Set up Python ${{ vars.PYTHON_VERSION_WORKFLOWS }} 🐍
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install and configure Poetry
@@ -41,7 +79,7 @@ jobs:
           virtualenvs-path: ~/.virtualenvs
           installer-parallel: true
       - name: Cache Poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         id: cache
         with:
           path: ~/.virtualenvs
@@ -62,7 +100,7 @@ jobs:
         run: pip install poethepoet
       - name: Get test data
         id: cache-test-data
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: test-data
           key: test-data-v2
@@ -80,3 +118,5 @@ jobs:
           poetry build
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
diff --git a/.github/workflows/unittests-capi.yml b/.github/workflows/unittests-capi.yml
index bfea44a7c..40f588101 100644
--- a/.github/workflows/unittests-capi.yml
+++ b/.github/workflows/unittests-capi.yml
@@ -10,9 +10,9 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Install task runner
diff --git a/.github/workflows/unittests-pyapi.yml b/.github/workflows/unittests-pyapi.yml
index c166cb168..503dfe210 100644
--- a/.github/workflows/unittests-pyapi.yml
+++ b/.github/workflows/unittests-pyapi.yml
@@ -10,10 +10,10 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Setup Python
         id: setup-python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
       - name: Setup Rust toolchain
@@ -25,7 +25,7 @@ jobs:
           virtualenvs-in-project: true
           installer-parallel: true
       - name: Cache Poetry virtualenv
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         id: cache
         with:
           path: .venv
diff --git a/.github/workflows/unittests-rust.yml b/.github/workflows/unittests-rust.yml
index 480272cf3..73492ee77 100644
--- a/.github/workflows/unittests-rust.yml
+++ b/.github/workflows/unittests-rust.yml
@@ -10,10 +10,10 @@ jobs:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Get test data
         id: cache-test-data
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: test-data
           key: test-data-v2
@@ -21,7 +21,7 @@ jobs:
         if: steps.cache-test-data.outputs.cache-hit != 'true'
         run: |
           ./tests/data/assets.sh
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
       - name: Install task runner
         run: pip install poethepoet
       - name: Run fmt
diff --git a/crates/eko/pyproject.toml b/crates/eko/pyproject.toml
index 139adc220..9a3765843 100644
--- a/crates/eko/pyproject.toml
+++ b/crates/eko/pyproject.toml
@@ -4,6 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "eko-rs"
+readme="README.md"
 dynamic = ["version"]
 requires-python = ">=3.11"
 classifiers = [
diff --git a/crates/ekore_py/pyproject.toml b/crates/ekore_py/pyproject.toml
index 0d8c24bdf..e19975dd2 100644
--- a/crates/ekore_py/pyproject.toml
+++ b/crates/ekore_py/pyproject.toml
@@ -4,6 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "ekore-rs"
+readme="README.md"
 dynamic = ["version"]
 requires-python = ">=3.11"
 classifiers = [
diff --git a/src/eko/evolution_operator/__init__.py.patch b/src/eko/evolution_operator/__init__.py.patch
index 7c0698604..0b394c7a1 100644
--- a/src/eko/evolution_operator/__init__.py.patch
+++ b/src/eko/evolution_operator/__init__.py.patch
@@ -1,5 +1,5 @@
 diff --git a/src/eko/evolution_operator/__init__.py b/src/eko/evolution_operator/__init__.py
-index d25e6e4e..6c93b180 100644
+index 1c900594..6c93b180 100644
 --- a/src/eko/evolution_operator/__init__.py
 +++ b/src/eko/evolution_operator/__init__.py
 @@ -3,7 +3,6 @@ r"""Contains the central operator classes.
@@ -56,7 +56,7 @@ index d25e6e4e..6c93b180 100644
 -            order=self.order,
 -            mode0=label[0],
 -            mode1=label[1],
--            ev_method=self.ev_method,
+-            ev_method=int(self.ev_method),
 -            is_log=self.int_disp.log,
 -            logx=logx,
 -            areas=areas,
@@ -69,7 +69,7 @@ index d25e6e4e..6c93b180 100644
 -            Lsv=np.log(self.xif2),
 -            ev_op_iterations=self.config["ev_op_iterations"],
 -            ev_op_max_order=tuple(self.config["ev_op_max_order"]),
--            sv_mode=self.sv_mode,
+-            sv_mode=int(self.sv_mode),
 -            is_threshold=self.is_threshold,
 -            n3lo_ad_variation=self.config["n3lo_ad_variation"],
 -            is_polarized=self.config["polarized"],
diff --git a/src/eko/evolution_operator/operator_matrix_element.py.patch b/src/eko/evolution_operator/operator_matrix_element.py.patch
index a60e17326..b3573bc86 100644
--- a/src/eko/evolution_operator/operator_matrix_element.py.patch
+++ b/src/eko/evolution_operator/operator_matrix_element.py.patch
@@ -1,5 +1,5 @@
 diff --git a/src/eko/evolution_operator/operator_matrix_element.py b/src/eko/evolution_operator/operator_matrix_element.py
-index 9c41b1fa..c2e66e93 100644
+index 3bf847e5..c2e66e93 100644
 --- a/src/eko/evolution_operator/operator_matrix_element.py
 +++ b/src/eko/evolution_operator/operator_matrix_element.py
 @@ -2,10 +2,10 @@
@@ -56,9 +56,9 @@ index 9c41b1fa..c2e66e93 100644
 -            a_s=self.a_s,
 -            nf=self.nf,
 -            L=self.L,
--            sv_mode=self.sv_mode,
+-            sv_mode=int(self.sv_mode),
 -            Lsv=np.log(self.xif2),
--            backward_method=self.backward_method,
+-            backward_method=int(self.backward_method),
 -            is_msbar=self.is_msbar,
 -            is_polarized=self.config["polarized"],
 -            is_time_like=self.config["time_like"],
diff --git a/src/eko/evolution_operator/quad_ker.py.patch b/src/eko/evolution_operator/quad_ker.py.patch
index 34fe83766..b92a2bb40 100644
--- a/src/eko/evolution_operator/quad_ker.py.patch
+++ b/src/eko/evolution_operator/quad_ker.py.patch
@@ -1,5 +1,5 @@
 diff --git a/src/eko/evolution_operator/quad_ker.py b/src/eko/evolution_operator/quad_ker.py
-index 137ff7ec..57d7359f 100644
+index 08fc0114..7bd4c232 100644
 --- a/src/eko/evolution_operator/quad_ker.py
 +++ b/src/eko/evolution_operator/quad_ker.py
 @@ -6,14 +6,7 @@ import logging
@@ -18,7 +18,7 @@ index 137ff7ec..57d7359f 100644
  from .. import scale_variations as sv
  from ..kernels import non_singlet as ns
  from ..kernels import non_singlet_qed as qed_ns
-@@ -169,228 +162,82 @@ def build_ome(A, matching_order, a_s, backward_method):
+@@ -171,230 +164,82 @@ def build_ome(A, matching_order, a_s, backward_method):
      return ome
 
 
@@ -184,8 +184,9 @@ index 137ff7ec..57d7359f 100644
 -        pid for first sector element
 -    mode1 : int
 -        pid for second sector element
--    ev_method : str
--        ev_method
+-    ev_method : int
+-        evolution method, as the plain int value of the corresponding
+-        :class:`eko.kernels.EvoMethods` member
 -    is_log : boolean
 -        is a logarithmic interpolation
 -    logx : float
@@ -210,8 +211,9 @@ index 137ff7ec..57d7359f 100644
 -        number of evolution steps
 -    ev_op_max_order : int
 -        perturbative expansion order of U
--    sv_mode: int, `enum.IntEnum`
--        scale variation mode, see `eko.scale_variations.Modes`
+-    sv_mode : int
+-        scale variation mode, as the plain int value of the corresponding
+-        :class:`eko.scale_variations.Modes` member
 -    is_threshold : boolean
 -        is this an intermediate threshold operator?
 -    n3lo_ad_variation : tuple
@@ -313,7 +315,7 @@ index 137ff7ec..57d7359f 100644
  ):
      """Raw evolution kernel inside quad.
 
-@@ -432,20 +279,19 @@ def quad_ker_qcd(
+@@ -438,20 +283,19 @@ def quad_ker_qcd(
      float
          evaluated integration kernel
      """
@@ -347,7 +349,7 @@ index 137ff7ec..57d7359f 100644
          # scale var exponentiated is directly applied on gamma
          if sv_mode == sv.Modes.exponentiated:
              gamma_singlet = sv_exponentiated.gamma_variation(
-@@ -468,18 +314,10 @@ def quad_ker_qcd(
+@@ -474,18 +318,10 @@ def quad_ker_qcd(
              ) @ np.ascontiguousarray(ker)
          ker = select_singlet_element(ker, mode0, mode1)
      else:
@@ -370,7 +372,7 @@ index 137ff7ec..57d7359f 100644
          if sv_mode == sv.Modes.exponentiated:
              gamma_ns = sv_exponentiated.gamma_variation(gamma_ns, order, nf, Lsv)
          ker = ns.dispatcher(
-@@ -492,29 +330,50 @@ def quad_ker_qcd(
+@@ -498,29 +334,50 @@ def quad_ker_qcd(
          )
          if sv_mode == sv.Modes.expanded and not is_threshold:
              ker = sv_expanded.non_singlet_variation(gamma_ns, as1, order, nf, Lsv) * ker
@@ -438,7 +440,7 @@ index 137ff7ec..57d7359f 100644
  ):
      """Raw evolution kernel inside quad.
 
-@@ -564,11 +423,24 @@ def quad_ker_qed(
+@@ -572,11 +429,24 @@ def quad_ker_qed(
      float
          evaluated integration kernel
      """
@@ -468,7 +470,7 @@ index 137ff7ec..57d7359f 100644
          # scale var exponentiated is directly applied on gamma
          if sv_mode == sv.Modes.exponentiated:
              gamma_s = sv_exponentiated.gamma_variation_qed(
-@@ -595,11 +467,13 @@ def quad_ker_qed(
+@@ -603,11 +473,13 @@ def quad_ker_qed(
                  )
              ) @ np.ascontiguousarray(ker)
          ker = select_QEDsinglet_element(ker, mode0, mode1)
@@ -487,7 +489,7 @@ index 137ff7ec..57d7359f 100644
          if sv_mode == sv.Modes.exponentiated:
              gamma_v = sv_exponentiated.gamma_variation_qed(
                  gamma_v, order, nf, lepton_number(mu2_to), Lsv, alphaem_running
-@@ -623,10 +497,10 @@ def quad_ker_qed(
+@@ -631,10 +503,10 @@ def quad_ker_qed(
              ) @ np.ascontiguousarray(ker)
          ker = select_QEDvalence_element(ker, mode0, mode1)
      else:
@@ -502,7 +504,7 @@ index 137ff7ec..57d7359f 100644
          if sv_mode == sv.Modes.exponentiated:
              gamma_ns = sv_exponentiated.gamma_variation_qed(
                  gamma_ns, order, nf, lepton_number(mu2_to), Lsv, alphaem_running
-@@ -656,27 +530,50 @@ def quad_ker_qed(
+@@ -664,27 +536,50 @@ def quad_ker_qed(
                  )
                  * ker
              )
@@ -568,7 +570,7 @@ index 137ff7ec..57d7359f 100644
  ):
      r"""Raw kernel inside quad.
 
-@@ -716,33 +613,27 @@ def quad_ker_ome(
+@@ -726,33 +621,27 @@ def quad_ker_ome(
      ker : float
          evaluated integration kernel
      """
@@ -620,7 +622,7 @@ index 137ff7ec..57d7359f 100644
 
      # correct for scale variations
      if sv_mode == sv.Modes.exponentiated:
-@@ -755,4 +646,5 @@ def quad_ker_ome(
+@@ -765,4 +654,5 @@ def quad_ker_ome(
      ker = ker[indices[mode0], indices[mode1]]
 
      # recombine everything