diff --git a/.github/workflows/gh-pages.yml b/.github/workflows/gh-pages.yml
index b27ae1d08..6474bd0ac 100644
--- a/.github/workflows/gh-pages.yml
+++ b/.github/workflows/gh-pages.yml
@@ -13,14 +13,14 @@ jobs:
       id-token: write
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v4
+      - name: Use Node.js 24.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 22.x
+          node-version: 24.x
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: docs/package.json
 
@@ -34,9 +34,9 @@ jobs:
         run: pnpm --dir docs run build
 
       - name: Upload to GitHub Pages
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
         with:
           path: docs/dist
 
       - name: Deploy to GitHub Pages
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index b81bf6dfe..9494368b3 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -105,13 +105,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       # setup node + private repo access
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: 'https://npm.pkg.github.com'
@@ -121,13 +121,13 @@ jobs:
 
       - name: Set up Python
         if: ${{ inputs.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ inputs.python-version }}
 
       - name: Download artifacts
         if: ${{ inputs.download-artifact-name || inputs.download-artifact-pattern }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: ${{ inputs.download-artifact-name }}
           pattern: ${{ inputs.download-artifact-pattern }}
@@ -190,7 +190,7 @@ jobs:
 
       - name: Publish artifact
         if: ${{ inputs.upload-artifact-name }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ inputs.upload-artifact-name }}-node-${{ matrix.node-version }}
           path: ${{ inputs.upload-artifact-path }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 63ae6a844..2de1fa3f4 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -21,16 +21,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 22.x
+          node-version: 24.x
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: docs/package.json
 
diff --git a/.github/workflows/prod-release.yml b/.github/workflows/prod-release.yml
index f5e17bb32..4d252be6a 100644
--- a/.github/workflows/prod-release.yml
+++ b/.github/workflows/prod-release.yml
@@ -11,13 +11,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate bot token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         id: app_token
         with:
           app-id: ${{ secrets.BOT_ID }}
           private-key: ${{ secrets.BOT_SK }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # Fetch entire repository history so we can determine version number from it
           fetch-depth: 0
diff --git a/.github/workflows/publish-devportal-docs.yml b/.github/workflows/publish-devportal-docs.yml
index 0fdbd3630..43933871c 100644
--- a/.github/workflows/publish-devportal-docs.yml
+++ b/.github/workflows/publish-devportal-docs.yml
@@ -17,9 +17,9 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 22
+          node-version: 24.x
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: docs/package.json
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b6af700a4..125ff8773 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,6 +15,7 @@ permissions:
   issues: write
   pull-requests: write
   checks: write
+  id-token: write
 
 jobs:
   ci:
@@ -29,27 +30,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate bot token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v3
         id: app_token
         with:
           app-id: ${{ secrets.BOT_ID }}
           private-key: ${{ secrets.BOT_SK }}
 
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           token: ${{ steps.app_token.outputs.token }}
 
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v4
+      - name: Use Node.js 24.x
+        uses: actions/setup-node@v6
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - run: npm ci --ignore-scripts
 
       - name: Download package artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           pattern: '*-node-22.x'
           path: artifacts
@@ -73,21 +74,21 @@ jobs:
           npm pkg set version=$newVersion
 
       - name: Publish @algorandfoundation/algorand-typescript
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@v4
         id: publish-algo-ts
         with:
-          token: ${{ secrets.NPM_TOKEN }}
           package: artifacts/algo-ts/package.json
           access: 'public'
+          provenance: true
           tag: ${{ github.ref_name == 'alpha' && 'alpha' || github.ref_name == 'main' && 'beta' || github.ref_name == 'release' && 'latest' || 'pre-release' }}
 
       - name: Publish @algorandfoundation/puya-ts
-        uses: JS-DevTools/npm-publish@v3
+        uses: JS-DevTools/npm-publish@v4
         id: publish-puya-ts
         with:
-          token: ${{ secrets.NPM_TOKEN }}
           package: artifacts/puya-ts/package.json
           access: 'public'
+          provenance: true
           tag: ${{ github.ref_name == 'alpha' && 'alpha' || github.ref_name == 'main' && 'beta' || github.ref_name == 'release' && 'latest' || 'pre-release' }}
 
   publish-docs:
diff --git a/package.json b/package.json
index 7ea090b93..669cc103b 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,10 @@
   "version": "1.0.0",
   "description": "Compiles Algorand TypeScript into byte code which runs on the Algorand Virtual Machine (AVM)",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/algorandfoundation/puya-ts.git"
+  },
   "types": "src/index.ts",
   "scripts": {
     "postinstall": "npm run algo-ts",
diff --git a/packages/algo-ts/package.json b/packages/algo-ts/package.json
index e32fe0432..8b0ef370f 100644
--- a/packages/algo-ts/package.json
+++ b/packages/algo-ts/package.json
@@ -3,6 +3,11 @@
   "version": "1.0.0",
   "description": "This package contains definitions for the types which comprise Algorand TypeScript which can be compiled to run on the Algorand Virtual Machine using the Puya compiler.",
   "private": false,
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/algorandfoundation/puya-ts.git",
+    "directory": "packages/algo-ts"
+  },
   "main": "index.js",
   "types": "src/index.ts",
   "scripts": {