diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 67e34d6..e1b2157 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,7 +13,7 @@ jobs:
           node-version: 18
       - name: Get yarn cache
         id: yarn-cache
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
       - name: Cache node modules
         uses: actions/cache@v4
         with:
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 880b5ed..4ec7867 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -2,12 +2,46 @@ name: publish
 on:
   push:
     branches: [master, main]
+permissions:
+  contents: write
 jobs:
-  tag:
-    runs-on: ubuntu-latest
+  publish:
+    runs-on: ubuntu-22.04
+    environment: production
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: 18
+      - name: Get yarn cache
+        id: yarn-cache
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      - name: Cache node modules
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.yarn-cache.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+      - name: Install
+        run: yarn --prefer-offline --frozen-lockfile --no-progress --non-interactive
+      - name: Build
+        run: yarn build
+      - name: Package
+        run: yarn package
+      - name: Import GPG key
+        uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172
+        with:
+          gpg_private_key: ${{ secrets.NEOBOT_GPG_PRIVATE_KEY }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+      - name: Commit latest build artifacts
+        uses: endbug/add-and-commit@v7
+        with:
+          author_name: ${{ vars.NEOBOT_AUTHOR }}
+          author_email: ${{ vars.NEOBOT_AUTHOR_EMAIL }}
+          signoff: true
       - uses: Saionaro/extract-package-version@de8268c348d3a9ed3514c86a9ad8d4568ab8b49e
         id: extract_version
       - uses: mathieudutour/github-tag-action@d745f2e74aaf1ee82e747b181f7a0967978abee0
@@ -16,7 +50,8 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           custom_tag: ${{ steps.extract_version.outputs.version }}
   coverage:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
+    environment: production
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v2
@@ -25,7 +60,7 @@ jobs:
           node-version: 18
       - name: Get yarn cache
         id: yarn-cache
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
       - name: Cache node modules
         uses: actions/cache@v4
         with:
@@ -38,9 +73,9 @@ jobs:
       - name: Test
         run: yarn test
       - name: Coverage
-        uses: neofinancial/coverage-upload-action@0ffd2ee97816db805bdedcca37bcac50b9521f37
+        uses: neofinancial/coverage-upload-action@v2
         with:
           coverageEndpoint: ${{ secrets.COVERAGE_ENDPOINT }}
           coverageToken: ${{secrets.COVERAGE_TOKEN}}
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
\ No newline at end of file
diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml
index 8840020..b1a5490 100644
--- a/.github/workflows/pull-request.yaml
+++ b/.github/workflows/pull-request.yaml
@@ -13,7 +13,7 @@ jobs:
           node-version: 18
       - name: Get yarn cache
         id: yarn-cache
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
       - name: Cache node modules
         uses: actions/cache@v4
         with:
@@ -38,18 +38,4 @@ jobs:
           instance-dbName: validation
           instance-port: 27018
           instance-storageEngine: wiredTiger
-          mongoms-debug: 1
-      - name: Package
-        run: yarn package
-      - name: Import GPG key
-        uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172
-        with:
-          gpg_private_key: ${{ secrets.NEOBOT_GPG_PRIVATE_KEY }}
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-      - name: Commit latest build artifacts
-        uses: endbug/add-and-commit@v7
-        with:
-          author_name: ${{ secrets.NEOBOT_AUTHOR }}
-          author_email: ${{ secrets.NEOBOT_AUTHOR_EMAIL }}
-          signoff: true
+          mongoms-debug: 1
\ No newline at end of file
diff --git a/README.md b/README.md
index e26488d..3eadb8a 100644
--- a/README.md
+++ b/README.md
@@ -49,6 +49,7 @@ The memory-server is stopped (and destroyed) subsequent to the completion of thi
 ### Testing
 
 This repository's CI workflow has a 'validate' job @ `src/validate.ts` (technically, `build/validate.js`) for internal, CI-time testing of the action's functionality; this simply opens and closes a connection to the memory-server to ensure the validity of the provided ENV variable. There are also a small number of unit tests to ensure the memory-server's configuration values are passed to the memory-server appropriately.
+If you're looking to reference this action before it's released, make sure to build it and commit the output manually. This step is automatic once the PR is merged to `master`.
 
 - please try to cover the new capability when making small changes
 - as necessary, add validation for variables passed directly to the initialization of the memory-server