diff --git a/.env.ci b/.env.ci
index 687f02d..9b69508 100644
Binary files a/.env.ci and b/.env.ci differ
diff --git a/.github/composite/setup/action.yaml b/.github/composite/setup/action.yaml
index 13e6afc..ea8e758 100644
--- a/.github/composite/setup/action.yaml
+++ b/.github/composite/setup/action.yaml
@@ -16,41 +16,9 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Export GitHub Token
-      shell: bash
-      run: echo "GH_TOKEN=${{ inputs.GITHUB_TOKEN }}" >> $GITHUB_ENV
-
-    - name: Disable man-db
-      shell: bash
-      run: sudo bash -ec 'echo "set man-db/auto-update false" | debconf-communicate; dpkg-reconfigure man-db'
-
-    - uses: oven-sh/setup-bun@v2
+    - name: Setup
+      uses: tahminator/pipeline/actions/setup@1.0.17
       with:
-        bun-version: latest
-
-    - name: Cache Bun dependencies
-      uses: actions/cache@v5
-      with:
-        path: ~/.bun/install/cache
-        key: ${{ runner.os }}-bun-${{ hashFiles('.github/scripts/bun.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-bun-
-
-    - name: Install deps
-      shell: bash
-      run: bun install --cwd .github/scripts --frozen-lockfile
-
-    - name: Test CI scripts
-      shell: bash
-      run: bun run --cwd .github/scripts test
-
-    - name: Load GPG secret key
-      uses: crazy-max/ghaction-import-gpg@v6
-      if: inputs.GPG_PRIVATE_KEY != '' && inputs.GPG_PASSPHRASE != ''
-      with:
-        gpg_private_key: ${{ inputs.GPG_PRIVATE_KEY }}
-        passphrase: ${{ inputs.GPG_PASSPHRASE }}
-
-    - name: Install git-crypt
-      if: inputs.GPG_PRIVATE_KEY != '' && inputs.GPG_PASSPHRASE != ''
-      uses: flydiverny/setup-git-crypt@v4
+        GPG_PASSPHRASE: ${{ inputs.GPG_PASSPHRASE }}
+        GPG_PRIVATE_KEY: ${{ inputs.GPG_PRIVATE_KEY }}
+        GITHUB_TOKEN: ${{ inputs.GITHUB_TOKEN }}
diff --git a/.github/scripts/bun.lock b/.github/scripts/bun.lock
index fec6979..e73c0bc 100644
--- a/.github/scripts/bun.lock
+++ b/.github/scripts/bun.lock
@@ -6,7 +6,7 @@
       "name": "scripts",
       "dependencies": {
         "@octokit/rest": "^22.0.1",
-        "@tahminator/pipeline": "^1.0.9",
+        "@tahminator/pipeline": "^1.0.16",
         "@types/yargs": "^17.0.35",
         "bun": "^1.3.6",
         "octokit": "^5.0.5",
@@ -181,7 +181,7 @@
 
     "@oven/bun-windows-x64-baseline": ["@oven/bun-windows-x64-baseline@1.3.11", "", { "os": "win32", "cpu": "x64" }, "sha512-cCsXK9AQ9Zf18QlVnbrFu2IKfr4sf2sfbErkF2jfCzyCO9Bnhl0KRx63zlN+Ni1xU7gcBLAssgcui5R400N2eA=="],
 
-    "@tahminator/pipeline": ["@tahminator/pipeline@1.0.9", "", { "dependencies": { "@octokit/rest": "^22.0.1", "@types/semver": "^7.7.1", "semver": "^7.7.4", "yaml": "^2.8.2", "zod": "^4.3.6" }, "peerDependencies": { "typescript": "^5" } }, "sha512-MdoaNhZ5o+iGVTQaeF4dJddPodCfsASEq1IQOrxMvNTjG2O5LdIVYOVaWkiQ6E0wvkZZ9FMjF91zSkLOU9FJGQ=="],
+    "@tahminator/pipeline": ["@tahminator/pipeline@1.0.16", "", { "dependencies": { "@octokit/rest": "^22.0.1", "@types/semver": "^7.7.1", "@types/yargs": "^17.0.35", "semver": "^7.7.4", "yaml": "^2.8.2", "yargs": "^18.0.0", "zod": "^4.3.6" }, "peerDependencies": { "typescript": "^5" } }, "sha512-vsOsQtmQgI504eS/6mEC08SDic8cyqkLUhrNWdZ83UWhpoMlqc8KqDuLx85UGJY1Z2vhapOcqin2OA/61RZ+5A=="],
 
     "@types/aws-lambda": ["@types/aws-lambda@8.10.161", "", {}, "sha512-rUYdp+MQwSFocxIOcSsYSF3YYYC/uUpMbCY/mbO21vGqfrEYvNSoPyKYDj6RhXXpPfS0KstW9RwG3qXh9sL7FQ=="],
 
diff --git a/.github/scripts/package.json b/.github/scripts/package.json
index 6f51389..a772917 100644
--- a/.github/scripts/package.json
+++ b/.github/scripts/package.json
@@ -17,7 +17,7 @@
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.1",
-    "@tahminator/pipeline": "^1.0.9",
+    "@tahminator/pipeline": "^1.0.16",
     "@types/yargs": "^17.0.35",
     "bun": "^1.3.6",
     "octokit": "^5.0.5",
diff --git a/.github/scripts/src/upload-npm/index.ts b/.github/scripts/src/upload-npm/index.ts
index 400ea18..bb2808c 100644
--- a/.github/scripts/src/upload-npm/index.ts
+++ b/.github/scripts/src/upload-npm/index.ts
@@ -1,25 +1,11 @@
 import { NPMClient } from "@tahminator/pipeline";
-import { Utils } from "@tahminator/pipeline";
 
 async function main() {
-  const { npmToken } = parseCiEnv(await Utils.getEnvVariables(["ci"]));
-  await using npmClient = await NPMClient.create(npmToken);
+  await using npmClient = await NPMClient.create();
 
   await npmClient.publish();
 }
 
-function parseCiEnv(ciEnv: Record<string, string>) {
-  const npmToken = (() => {
-    const v = ciEnv["NPM_TOKEN"];
-    if (!v) {
-      throw new Error("Missing NPM_TOKEN from .env.ci");
-    }
-    return v;
-  })();
-
-  return { npmToken };
-}
-
 main()
   .then(() => {
     process.exit(0);
diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index 29d3f9f..eba6880 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -4,6 +4,7 @@ run-name: Running continuous deployment on ${{ github.actor }}'s commits
 
 permissions:
   contents: read
+  id-token: write
 
 on:
   push:
@@ -31,7 +32,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24" # to be used for npm publish via OIDC
           cache: "pnpm"
 
       - name: Install Dependencies
diff --git a/package.json b/package.json
index 848fa8a..50a1a97 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,11 @@
 {
   "name": "@tahminator/sapling",
-  "version": "1.5.0",
+  "version": "0.0.0",
+  "author": "Tahmid Ahmed",
   "description": "A library to help you write cleaner Express.js code",
+  "repository": {
+    "url": "git+https://github.com/tahminator/pipeline.git"
+  },
   "scripts": {
     "test": "pnpm run build",
     "build": "rm -rf dist && tsc"
@@ -20,7 +24,6 @@
     "/dist"
   ],
   "keywords": [],
-  "author": "Tahmid Ahmed",
   "license": "ISC",
   "packageManager": "pnpm@10.12.4",
   "dependencies": {