diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0667cd7..3ec76ca8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,13 +15,13 @@ on:
     tags: [v*]
 
 env:
-  PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
-  SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-  SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
-  SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
-  PGP_SECRET: ${{ secrets.PGP_SECRET }}
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+
+concurrency:
+  group: ${{ github.workflow }} @ ${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build and Test
@@ -32,39 +32,25 @@ jobs:
         java: [temurin@8]
         project: [rootJS, rootJVM, rootNative]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download Java (temurin@8)
-        id: download-java-temurin-8
-        if: matrix.java == 'temurin@8'
-        uses: typelevel/download-java@v2
-        with:
-          distribution: temurin
-          java-version: 8
-
       - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
         uses: actions/setup-java@v3
         with:
-          distribution: jdkfile
+          distribution: temurin
           java-version: 8
-          jdkFile: ${{ steps.download-java-temurin-8.outputs.jdkFile }}
+          cache: sbt
 
-      - name: Cache sbt
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.sbt
-            ~/.ivy2/cache
-            ~/.coursier/cache/v1
-            ~/.cache/coursier/v1
-            ~/AppData/Local/Coursier/Cache/v1
-            ~/Library/Caches/Coursier/v1
-          key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
 
       - name: Check that workflows are up to date
         run: sbt githubWorkflowCheck
@@ -94,11 +80,11 @@ jobs:
 
       - name: Make target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/series/0.1')
-        run: mkdir -p modules/mtl/native/target modules/lightstep-grpc/target modules/log/jvm/target modules/noop/jvm/target modules/mock/target modules/examples/target modules/testkit/native/target target modules/log/native/target modules/testkit/js/target .js/target modules/core-tests/js/target modules/core/native/target modules/docs/target modules/lightstep-http/target modules/datadog/target modules/xray/.jvm/target modules/opentracing/target modules/noop/native/target modules/xray/.js/target modules/core/js/target modules/noop/js/target modules/core-tests/jvm/target modules/core/jvm/target .jvm/target modules/jaeger/target .native/target modules/opencensus/target modules/honeycomb/target modules/log/js/target modules/mtl/js/target modules/newrelic/target modules/log-odin/target modules/mtl/jvm/target modules/testkit/jvm/target modules/core-tests/native/target modules/opentelemetry/target modules/lightstep/target project/target
+        run: mkdir -p modules/mtl/native/target modules/lightstep-grpc/target modules/log/jvm/target modules/noop/jvm/target modules/mock/target modules/testkit/native/target modules/log/native/target modules/testkit/js/target modules/core/native/target modules/docs/target modules/lightstep-http/target modules/datadog/target modules/xray/.jvm/target modules/opentracing/target modules/noop/native/target modules/xray/.js/target modules/core/js/target modules/noop/js/target modules/core/jvm/target modules/jaeger/target modules/opencensus/target modules/honeycomb/target modules/log/js/target modules/mtl/js/target modules/newrelic/target modules/log-odin/target modules/mtl/jvm/target modules/testkit/jvm/target modules/opentelemetry/target modules/lightstep/target project/target
 
       - name: Compress target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/series/0.1')
-        run: tar cf targets.tar modules/mtl/native/target modules/lightstep-grpc/target modules/log/jvm/target modules/noop/jvm/target modules/mock/target modules/examples/target modules/testkit/native/target target modules/log/native/target modules/testkit/js/target .js/target modules/core-tests/js/target modules/core/native/target modules/docs/target modules/lightstep-http/target modules/datadog/target modules/xray/.jvm/target modules/opentracing/target modules/noop/native/target modules/xray/.js/target modules/core/js/target modules/noop/js/target modules/core-tests/jvm/target modules/core/jvm/target .jvm/target modules/jaeger/target .native/target modules/opencensus/target modules/honeycomb/target modules/log/js/target modules/mtl/js/target modules/newrelic/target modules/log-odin/target modules/mtl/jvm/target modules/testkit/jvm/target modules/core-tests/native/target modules/opentelemetry/target modules/lightstep/target project/target
+        run: tar cf targets.tar modules/mtl/native/target modules/lightstep-grpc/target modules/log/jvm/target modules/noop/jvm/target modules/mock/target modules/testkit/native/target modules/log/native/target modules/testkit/js/target modules/core/native/target modules/docs/target modules/lightstep-http/target modules/datadog/target modules/xray/.jvm/target modules/opentracing/target modules/noop/native/target modules/xray/.js/target modules/core/js/target modules/noop/js/target modules/core/jvm/target modules/jaeger/target modules/opencensus/target modules/honeycomb/target modules/log/js/target modules/mtl/js/target modules/newrelic/target modules/log-odin/target modules/mtl/jvm/target modules/testkit/jvm/target modules/opentelemetry/target modules/lightstep/target project/target
 
       - name: Upload target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/series/0.1')
@@ -118,37 +104,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download Java (temurin@8)
-        id: download-java-temurin-8
-        if: matrix.java == 'temurin@8'
-        uses: typelevel/download-java@v2
-        with:
-          distribution: temurin
-          java-version: 8
-
       - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
         uses: actions/setup-java@v3
         with:
-          distribution: jdkfile
+          distribution: temurin
           java-version: 8
-          jdkFile: ${{ steps.download-java-temurin-8.outputs.jdkFile }}
+          cache: sbt
 
-      - name: Cache sbt
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.sbt
-            ~/.ivy2/cache
-            ~/.coursier/cache/v1
-            ~/.cache/coursier/v1
-            ~/AppData/Local/Coursier/Cache/v1
-            ~/Library/Caches/Coursier/v1
-          key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
 
       - name: Download target directories (2.12, rootJS)
         uses: actions/download-artifact@v3
@@ -242,58 +213,86 @@ jobs:
 
       - name: Import signing key
         if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE == ''
-        run: echo $PGP_SECRET | base64 -di | gpg --import
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
+        run: echo $PGP_SECRET | base64 -d -i - | gpg --import
 
       - name: Import signing key and strip passphrase
         if: env.PGP_SECRET != '' && env.PGP_PASSPHRASE != ''
+        env:
+          PGP_SECRET: ${{ secrets.PGP_SECRET }}
+          PGP_PASSPHRASE: ${{ secrets.PGP_PASSPHRASE }}
         run: |
-          echo "$PGP_SECRET" | base64 -di > /tmp/signing-key.gpg
+          echo "$PGP_SECRET" | base64 -d -i - > /tmp/signing-key.gpg
           echo "$PGP_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --import /tmp/signing-key.gpg
           (echo "$PGP_PASSPHRASE"; echo; echo) | gpg --command-fd 0 --pinentry-mode loopback --change-passphrase $(gpg --list-secret-keys --with-colons 2> /dev/null | grep '^sec:' | cut --delimiter ':' --fields 5 | tail -n 1)
 
       - name: Publish
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          SONATYPE_CREDENTIAL_HOST: ${{ secrets.SONATYPE_CREDENTIAL_HOST }}
         run: sbt tlCiRelease
 
-  docs:
-    name: Make site
+  dependency-submission:
+    name: Submit Dependencies
+    if: github.event_name != 'pull_request'
     strategy:
       matrix:
         os: [ubuntu-latest]
-        scala: [2.13.11]
-        java: [temurin@11]
+        java: [temurin@8]
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download Java (temurin@8)
-        id: download-java-temurin-8
+      - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
-        uses: typelevel/download-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: temurin
           java-version: 8
+          cache: sbt
+
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
+
+      - name: Submit Dependencies
+        uses: scalacenter/sbt-dependency-submission@v2
+        with:
+          modules-ignore: natchez-examples_2.12 natchez-examples_2.13 natchez-examples_3 rootjs_2.12 rootjs_2.13 rootjs_3 coretests_sjs1_2.12 coretests_sjs1_2.13 coretests_sjs1_3 coretests_2.12 coretests_2.13 coretests_3 rootjvm_2.12 rootjvm_2.13 rootjvm_3 rootnative_2.12 rootnative_2.13 rootnative_3 coretests_native0.4_2.12 coretests_native0.4_2.13 coretests_native0.4_3
+          configs-ignore: test scala-tool scala-doc-tool test-internal
+
+  docs:
+    name: Make site
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        scala: [2.13.11]
+        java: [temurin@11]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout current branch (full)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Setup Java (temurin@8)
+        id: setup-java-temurin-8
         if: matrix.java == 'temurin@8'
         uses: actions/setup-java@v3
         with:
-          distribution: jdkfile
+          distribution: temurin
           java-version: 8
-          jdkFile: ${{ steps.download-java-temurin-8.outputs.jdkFile }}
+          cache: sbt
 
-      - name: Cache sbt
-        uses: actions/cache@v3
-        with:
-          path: |
-            ~/.sbt
-            ~/.ivy2/cache
-            ~/.coursier/cache/v1
-            ~/.cache/coursier/v1
-            ~/AppData/Local/Coursier/Cache/v1
-            ~/Library/Caches/Coursier/v1
-          key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
+      - name: sbt update
+        if: matrix.java == 'temurin@8' && steps.setup-java-temurin-8.outputs.cache-hit == 'false'
+        run: sbt +update
 
       - run: sbt '++ ${{ matrix.scala }}' docs/makeSite
diff --git a/build.sbt b/build.sbt
index bba29f05..8921dce9 100644
--- a/build.sbt
+++ b/build.sbt
@@ -8,7 +8,7 @@ val scala30Version = "3.3.0"
 
 val collectionCompatVersion = "2.11.0"
 
-val catsVersion = "2.9.0"
+val catsVersion = "2.10.0"
 val catsEffectVersion = "3.5.1"
 val fs2Version = "3.6.1"
 
@@ -407,7 +407,7 @@ lazy val docs = project
   .enablePlugins(MdocPlugin)
   .settings(
     scalacOptions := Nil,
-    git.remoteRepo := "git@github.com:tpolecat/natchez.git",
+    git.remoteRepo := "git@github.com:typelevel/natchez.git",
     ghpagesNoJekyll := true,
     publish / skip := true,
     paradoxTheme := Some(builtinParadoxTheme("generic")),
diff --git a/project/plugins.sbt b/project/plugins.sbt
index d7b1e978..60fa932a 100644
--- a/project/plugins.sbt
+++ b/project/plugins.sbt
@@ -1,10 +1,16 @@
-addSbtPlugin("org.typelevel" % "sbt-typelevel" % "0.4.22")
-addSbtPlugin("org.typelevel" % "sbt-typelevel-mergify" % "0.4.22")
-addSbtPlugin("com.lightbend.paradox" % "sbt-paradox" % "0.10.3")
-addSbtPlugin("com.typesafe.sbt" % "sbt-site" % "1.4.1")
-addSbtPlugin("com.typesafe.sbt" % "sbt-ghpages" % "0.6.3")
+// https://github.com/sbt/sbt/issues/6997
+ThisBuild / libraryDependencySchemes ++= Seq(
+  "org.scala-lang.modules" %% "scala-xml" % VersionScheme.Always
+)
+
+addSbtPlugin("org.typelevel" % "sbt-typelevel" % "0.6.1")
+addSbtPlugin("org.typelevel" % "sbt-typelevel-mergify" % "0.6.1")
+addSbtPlugin("com.lightbend.paradox" % "sbt-paradox" % "0.10.5")
+addSbtPlugin("com.github.sbt" % "sbt-site" % "1.5.0")
+addSbtPlugin("com.github.sbt" % "sbt-site-paradox" % "1.5.0")
+addSbtPlugin("com.github.sbt" % "sbt-ghpages" % "0.8.0")
 addSbtPlugin("com.timushev.sbt" % "sbt-updates" % "0.6.4")
-addSbtPlugin("org.scala-js" % "sbt-scalajs" % "1.13.2")
-addSbtPlugin("org.scala-native" % "sbt-scala-native" % "0.4.14")
+addSbtPlugin("org.scala-js" % "sbt-scalajs" % "1.14.0")
+addSbtPlugin("org.scala-native" % "sbt-scala-native" % "0.4.16")
 addSbtPlugin("org.portable-scala" % "sbt-scala-native-crossproject" % "1.3.1")
-addSbtPlugin("org.scalameta" % "sbt-mdoc" % "2.3.7")
+addSbtPlugin("org.scalameta" % "sbt-mdoc" % "2.3.8")