diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..a91a109
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,37 @@
+on:
+    push:
+        branches:
+            - master
+
+permissions:
+    contents: write
+    pull-requests: write
+    id-token: write
+
+name: release
+jobs:
+    release-please:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: google-github-actions/release-please-action@v3
+              id: release
+              with:
+                  release-type: node
+                  package-name: ${{vars.NPM_MODULE_NAME}}
+                  pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
+            # The logic below handles the npm publication:
+            - uses: actions/checkout@v4
+              # these if statements ensure that a publication only occurs when
+              # a new release is created:
+              if: ${{ steps.release.outputs.release_created }}
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: 20
+                  registry-url: 'https://registry.npmjs.org'
+              if: ${{ steps.release.outputs.release_created }}
+            - run: npm ci
+              if: ${{ steps.release.outputs.release_created }}
+            - run: npm publish --provenance --access public
+              env:
+                  NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+              if: ${{ steps.release.outputs.release_created }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..2042d8c
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,21 @@
+name: Run tests
+
+on:
+    push:
+    pull_request:
+
+jobs:
+    test:
+        strategy:
+            matrix:
+                node: [16.x, 18.x, 20.x, 21.x]
+                os: [ubuntu-latest, windows-latest]
+        runs-on: ${{ matrix.os }}
+        steps:
+            - uses: actions/checkout@v4
+            - name: Use Node.js ${{ matrix.node }}
+              uses: actions/setup-node@v3
+              with:
+                  node-version: ${{ matrix.node }}
+            - run: npm install
+            - run: npm test
diff --git a/.ncurc.js b/.ncurc.js
new file mode 100644
index 0000000..d5ef847
--- /dev/null
+++ b/.ncurc.js
@@ -0,0 +1,7 @@
+module.exports = {
+    upgrade: true,
+    reject: [
+        // only works as ESM
+        'chai'
+    ]
+};
diff --git a/build-root-store.js b/build-root-store.js
index 5ffd1f7..fed6c04 100644
--- a/build-root-store.js
+++ b/build-root-store.js
@@ -1,5 +1,7 @@
 'use strict';
 
+// Root certificates from https://bimigroup.org/vmc-issuers/
+
 const Path = require('path');
 const fs = require('fs').promises;
 const { parsePemBundle } = require('./lib/tools');
diff --git a/package.json b/package.json
index aecbbfb..f8472e4 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,11 @@
     "scripts": {
         "test": "eslint \"lib/**/*.js\" \"test/**/*.js\" && mocha --recursive \"./test/**/*.js\" --reporter spec",
         "root-store": "node build-root-store.js",
-        "prepublish": "npm run root-store || true"
+        "update": "rm -rf node_modules package-lock.json && ncu -u && npm install && npm run root-store"
+    },
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/postalsys/vmc.git"
     },
     "keywords": [
         "VMC"
@@ -14,15 +18,15 @@
     "author": "Postal Systems OÜ",
     "license": "MIT",
     "dependencies": {
-        "@peculiar/asn1-schema": "2.3.0",
-        "@peculiar/asn1-x509": "2.3.0",
-        "@peculiar/asn1-x509-logotype": "2.3.0"
+        "@peculiar/asn1-schema": "2.3.8",
+        "@peculiar/asn1-x509": "2.3.8",
+        "@peculiar/asn1-x509-logotype": "2.3.8"
     },
     "devDependencies": {
-        "chai": "4.3.6",
-        "eslint": "8.22.0",
+        "chai": "4.4.1",
+        "eslint": "8.56.0",
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "8.5.0",
-        "mocha": "10.0.0"
+        "eslint-config-prettier": "9.1.0",
+        "mocha": "10.2.0"
     }
 }