diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ba76f62..7db7281 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,9 +4,11 @@ updates:
   directory: "/"
   schedule:
     interval: daily
-  open-pull-requests-limit: 10
 - package-ecosystem: cargo
   directory: "/"
   schedule:
     interval: daily
-  open-pull-requests-limit: 10
+- package-ecosystem: rust-toolchain
+  directory: "/"
+  schedule:
+    interval: daily
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index fee332d..f77a712 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -3,7 +3,8 @@ name: CI
 on:
   push: 
     branches:
-    - main
+    - '**'
+    - '!dependabot/**'
     tags:
     - 'v[0-9]+\.[0-9]+\.[0-9]+-?**'
   pull_request: {}
@@ -16,8 +17,6 @@ jobs:
     - uses: actions-rust-lang/setup-rust-toolchain@v1
     - name: Install cargo binstall
       uses: cargo-bins/cargo-binstall@main
-    - name: Install cargo component
-      run: cargo binstall --force cargo-component
     - name: Install wac
       run: cargo binstall --force wac-cli
     - name: Install wasmtime
@@ -49,18 +48,19 @@ jobs:
       working-directory: ./lib
       run: |
         for component in *.wasm ; do
-          echo "::group::${component}"
+          echo "::group::${component} ($(du -h ${component} | cut -f1 ))"
             wasm-tools component wit "${component}"
           echo "::endgroup::"
         done
 
   publish:
-    if: startsWith(github.ref, 'refs/tags/')
+    if: github.event_name == 'push' && ( startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' )
     needs:
     - build
     permissions:
       contents: write
       packages: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v6
@@ -69,7 +69,10 @@ jobs:
       uses: cargo-bins/cargo-binstall@main
     - name: Install wkg
       run: cargo binstall --force wkg
-    - name: Get the version
+    - name: Install cosign
+      uses: sigstore/cosign-installer@v4.1.2
+    - name: Get tag version
+      if: startsWith(github.ref, 'refs/tags/')
       id: get_version
       run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
     - name: Download components.tar
@@ -88,8 +91,9 @@ jobs:
       run: make publish
       env:
         REPOSITORY: "ghcr.io/${{ github.repository }}"
-        VERSION: "${{ steps.get_version.outputs.VERSION }}"
+        VERSION: "${{ case(github.ref == 'refs/heads/main', 'dev', steps.get_version.outputs.VERSION) }}"
     - name: Draft GitHub Release
+      if: startsWith(github.ref, 'refs/tags/')
       uses: softprops/action-gh-release@v3
       with:
         draft: true
diff --git a/Makefile b/Makefile
index f38d65d..c2ebd30 100644
--- a/Makefile
+++ b/Makefile
@@ -24,22 +24,22 @@ lib/interface.wasm: wit/deps README.md
 
 define BUILD_COMPONENT
 # $1 - component
-# $2 - release target
+# $2 - target
 # $3 - release target deps
 # $4 - debug target deps
 
 lib/$1.wasm: $3 Cargo.toml Cargo.lock components/wit/deps $(shell find components/wit -type f) $(shell find components/$1 -type f)
-	cargo component build -p $1 --target $2 --release
+	cargo build -p $1 --target $2 --release
 	$(if $(findstring $1,cli),
 		wac plug target/$2/release/$(subst -,_,$1).wasm --plug lib/valkey-ops.wasm -o lib/$1.wasm,
-		cp target/$2/release/$(subst -,_,$1).wasm lib/$1.wasm)
+		wasm-tools component new target/$2/release/$(subst -,_,$1).wasm -o lib/$1.wasm)
 	cp components/$1/README.md lib/$1.wasm.md
 
 lib/$1.debug.wasm: $4 Cargo.toml Cargo.lock wit/deps $(shell find components/$1 -type f)
-	cargo component build -p $1 --target wasm32-wasip2
+	cargo build -p $1 --target $2
 	$(if $(findstring $1,cli),
 		wac plug target/$2/debug/$(subst -,_,$1).wasm --plug lib/valkey-ops.debug.wasm -o lib/$1.debug.wasm,
-		cp target/wasm32-wasip2/debug/$(subst -,_,$1).wasm lib/$1.debug.wasm)
+		wasm-tools component new target/$2/debug/$(subst -,_,$1).wasm -o lib/$1.debug.wasm)
 	cp components/$1/README.md lib/$1.debug.wasm.md
 
 endef
@@ -95,12 +95,20 @@ endif
 	@$(eval REVISION := $(shell git rev-parse HEAD)$(shell git diff --quiet HEAD && echo "+dirty"))
 	@$(eval TAG := $(shell echo "${VERSION}" | sed 's/[^a-zA-Z0-9_.\-]/--/g'))
 
-	wkg oci push \
-        --annotation "org.opencontainers.image.title=${COMPONENT}" \
-        --annotation "org.opencontainers.image.description=${DESCRIPTION}" \
-        --annotation "org.opencontainers.image.version=${VERSION}" \
-        --annotation "org.opencontainers.image.source=https://github.com/componentized/valkey.git" \
-        --annotation "org.opencontainers.image.revision=${REVISION}" \
-        --annotation "org.opencontainers.image.licenses=Apache-2.0" \
-        "${REPOSITORY}/${COMPONENT}:${TAG}" \
-        "lib/${FILE}"
+	@echo "::group::${FILE} -> ${REPOSITORY}/${COMPONENT}:${TAG}"
+	@DIGEST=$$( \
+		wkg oci push \
+			--annotation "org.opencontainers.image.title=${COMPONENT}" \
+			--annotation "org.opencontainers.image.description=${DESCRIPTION}" \
+			--annotation "org.opencontainers.image.version=${VERSION}" \
+			--annotation "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}.git" \
+			--annotation "org.opencontainers.image.revision=${REVISION}" \
+			--annotation "org.opencontainers.image.licenses=Apache-2.0" \
+			"${REPOSITORY}/${COMPONENT}:${TAG}" \
+			"lib/${FILE}" \
+			2>&1 \
+			| tee /dev/stderr \
+			| grep -o 'sha256:[a-f0-9]\{64\}' \
+	) ; \
+	cosign sign --yes "${REPOSITORY}/${COMPONENT}:${TAG}@$${DIGEST}"
+	@echo "::endgroup::"