diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e04d056e..35d86d0f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,7 @@ on:
     branches:
       - main
       - beta
+
 jobs:
   js:
     name: Release (JS)
@@ -18,50 +19,87 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version-file: ".node-version"
+          cache: 'npm'
+
       - name: Install dependencies
         run: npm ci
+
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm run semantic-release
+
   kotlin:
     needs: js
-    if: ${{ github.ref_name == 'main' }}
     name: Release (Kotlin)
+    permissions:
+      id-token: write
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout project sources
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v3
-      - name: Validate Gradle Wrapper
-        uses: gradle/wrapper-validation-action@v1
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          validate-wrappers: true
+          cache-read-only: false
+
       - name: Generate protobufs
         run: dev/kotlin/generate
-      - name: Run build with Gradle Wrapper
-        run: ./gradlew build
+
       - name: Set Tag
+        id: set-tag
         run: |
-          TAG=`echo $(git describe --tags --abbrev=0)`
-          echo "GIT_TAG=${TAG#v}" >> $GITHUB_ENV
+          git fetch --tags --prune
+          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -z "$TAG" ]; then
+            echo "::error::No git tag found. Cannot determine release version."
+            exit 1
+          fi
+          VERSION="${TAG#v}"
+          echo "GIT_TAG=${VERSION}" >> $GITHUB_ENV
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "RELEASE_VERSION=${VERSION}" >> $GITHUB_ENV
+          echo "Publishing version: ${VERSION}"
+
+      - name: Run build with Gradle Wrapper
+        env:
+          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
+          MAVEN_PROFILE_ID: ${{ secrets.MAVEN_PROFILE_ID }}
+        run: ./gradlew build --no-daemon
+
       - name: Gradle Publish
         env:
-          RELEASE_VERSION: ${{ env.GIT_TAG }}
-          ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.OSSRH_USERNAME }}
-          ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.OSSRH_TOKEN }}
+          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
           ORG_GRADLE_PROJECT_signingKey: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
           ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
-          ORG_GRADLE_PROJECT_stagingProfileId: ${{ secrets.MAVEN_PROFILE_ID }}
+          MAVEN_PROFILE_ID: ${{ secrets.MAVEN_PROFILE_ID }}
         run: |
-          echo "Publishing version: $RELEASE_VERSION"
           if [ -z "$RELEASE_VERSION" ]; then
-            echo "Error: RELEASE_VERSION is empty"
+            echo "::error::RELEASE_VERSION is empty"
             exit 1
           fi
-          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository --info --stacktrace
+          echo "Publishing version: $RELEASE_VERSION to Maven Central"
+          ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository --no-daemon --stacktrace
\ No newline at end of file
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 11444cf1..92dda71f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version-file: ".node-version"
+          cache: 'npm'
       - run: npm ci
       - run: npm test
   kotlin:
@@ -21,14 +22,25 @@ jobs:
     steps:
       - name: Checkout project sources
         uses: actions/checkout@v5
+
+      - name: Setup Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+
       - name: Setup Gradle
-        uses: gradle/gradle-build-action@v3
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v3
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          validate-wrappers: true
+          cache-read-only: false
+
       - name: Generate protobufs
         run: dev/kotlin/generate
+
       - name: Run build with Gradle Wrapper
         run: ./gradlew build
+
       - name: Gradle Run Tests
         run: ./gradlew kotlin:test
   golang:
diff --git a/build.gradle b/build.gradle
index d8b2e3af..ffc4dd87 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id 'io.github.gradle-nexus.publish-plugin' version "1.2.0"
+    id 'io.github.gradle-nexus.publish-plugin' version "2.0.0"
 }
 
 group = "org.xmtp"
@@ -8,11 +8,19 @@ version = System.getenv("RELEASE_VERSION")
 nexusPublishing {
     repositories {
         sonatype {
-            nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
-            snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
-            username = project.findProperty("sonatypeUsername") ?: ""
-            password = project.findProperty("sonatypePassword") ?: ""
-            stagingProfileId = project.findProperty("stagingProfileId") ?: ""
+            username = System.getenv("MAVEN_USERNAME") ?: ""
+            password = System.getenv("MAVEN_PASSWORD") ?: ""
+
+            nexusUrl.set(uri("https://ossrh-staging-api.central.sonatype.com/service/local/"))
+            snapshotRepositoryUrl.set(uri("https://central.sonatype.com/repository/maven-snapshots/"))
         }
     }
-}
+
+    connectTimeout.set(Duration.ofMinutes(3))
+    clientTimeout.set(Duration.ofMinutes(3))
+
+    transitionCheckOptions {
+        maxRetries.set(50)
+        delayBetween.set(java.time.Duration.ofSeconds(10))
+    }
+}
\ No newline at end of file
diff --git a/dev/kotlin/protoc/Dockerfile b/dev/kotlin/protoc/Dockerfile
index c54b4fa2..1db5f184 100644
--- a/dev/kotlin/protoc/Dockerfile
+++ b/dev/kotlin/protoc/Dockerfile
@@ -19,8 +19,9 @@ RUN curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v$PRO
 ARG KOTLIN_GRPC_VERSION=1.3.0
 ARG KOTLIN_GRPC_URL=https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-kotlin/$KOTLIN_GRPC_VERSION/protoc-gen-grpc-kotlin-$KOTLIN_GRPC_VERSION-jdk8.jar
 
-RUN curl -fsSL -o protoc-gen-grpc-kotlin-$KOTLIN_GRPC_VERSION-jdk8.jar $KOTLIN_GRPC_URL
-RUN chmod +x protoc-gen-grpc-kotlin-$KOTLIN_GRPC_VERSION-jdk8.jar
+RUN mkdir -p /opt/protoc-plugins && \
+    curl -fsSL -o /opt/protoc-plugins/protoc-gen-grpc-kotlin-$KOTLIN_GRPC_VERSION-jdk8.jar $KOTLIN_GRPC_URL && \
+    chmod +x /opt/protoc-plugins/protoc-gen-grpc-kotlin-$KOTLIN_GRPC_VERSION-jdk8.jar
 
 # Java gRPC plugin
 ARG JAVA_GRPC_VERSION=1.45.1
diff --git a/dev/kotlin/protoc/protoc-gen-grpc-kotlin.sh b/dev/kotlin/protoc/protoc-gen-grpc-kotlin.sh
index f1a06739..d487061a 100755
--- a/dev/kotlin/protoc/protoc-gen-grpc-kotlin.sh
+++ b/dev/kotlin/protoc/protoc-gen-grpc-kotlin.sh
@@ -1,4 +1,22 @@
 #!/usr/bin/env sh
+set -eu
 
-DIR="$( cd '$( dirname "${BASH_SOURCE[0]}" )' >/dev/null 2>&1 && pwd )"
-java -jar $DIR/protoc-gen-grpc-kotlin-1.3.0-jdk8.jar "$@"
\ No newline at end of file
+# Prefer the plugin binary baked into the Docker image (added in the new Dockerfile),
+# but fall back to a jar that sits next to this script for local/manual use.
+if [ -x /bin/protoc-gen-grpc-kotlin ]; then
+  exec /bin/protoc-gen-grpc-kotlin "$@"
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" >/dev/null 2>&1 && pwd)"
+LOCAL_JAR="$SCRIPT_DIR/protoc-gen-grpc-kotlin-1.3.0-jdk8.jar"
+CONTAINER_JAR="/opt/protoc-plugins/protoc-gen-grpc-kotlin-1.3.0-jdk8.jar"
+
+if [ -f "$LOCAL_JAR" ]; then
+  exec java -jar "$LOCAL_JAR" "$@"
+elif [ -f "$CONTAINER_JAR" ]; then
+  exec java -jar "$CONTAINER_JAR" "$@"
+else
+  echo "Unable to find protoc-gen-grpc-kotlin jar" >&2
+  echo "Looked for $LOCAL_JAR and $CONTAINER_JAR" >&2
+  exit 1
+fi