diff --git a/.bazelignore b/.bazelignore
new file mode 100644
index 0000000..d838da9
--- /dev/null
+++ b/.bazelignore
@@ -0,0 +1 @@
+examples/
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..36806b9
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,6 @@
+#################################
+# Configuration for 'git archive'
+# See https://git-scm.com/docs/git-archive#ATTRIBUTES
+
+# Don't include examples in the distribution artifact, to reduce size.
+examples export-ignore
diff --git a/.github/workflows/buildifier.yaml b/.github/workflows/buildifier.yaml
index ac548ca..49f92ea 100644
--- a/.github/workflows/buildifier.yaml
+++ b/.github/workflows/buildifier.yaml
@@ -12,6 +12,6 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: buildifier
         run: bazel run --enable_bzlmod //.github/workflows:buildifier.check
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
deleted file mode 100644
index 3b4aad2..0000000
--- a/.github/workflows/ci.bazelrc
+++ /dev/null
@@ -1,15 +0,0 @@
-# This file contains Bazel settings to apply on CI only.
-# It is referenced with a --bazelrc option in the call to bazel in ci.yaml
-
-# Debug where options came from
-build --announce_rc
-# This directory is configured in GitHub actions to be persisted between runs.
-# We do not enable the repository cache to cache downloaded external artifacts
-# as these are generally faster to download again than to fetch them from the
-# GitHub actions cache.
-build --disk_cache=~/.cache/bazel
-# Don't rely on test logs being easily accessible from the test runner,
-# though it makes the log noisier.
-test --test_output=errors
-# Allows tests to run bazelisk-in-bazel, since this is the cache folder used
-test --test_env=XDG_CACHE_HOME
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3f86c73..ce5cae1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,21 +15,30 @@ concurrency:
   cancel-in-progress: ${{ github.ref_name != 'main' }}
 jobs:
   test:
-    uses: bazel-contrib/.github/.github/workflows/bazel.yaml@v7
-    with:
-      folders: |
-        [
-          ".",
-        ]
-      exclude: |
-        [
-          {"folder": ".", "bzlmodEnabled": false}
-        ]
-      bazel_test_command: "bazel build //..."
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        bazel: ["7.x", "8.x", "9.x"]
+        folder:
+          - .
+          - examples
+    defaults:
+      run:
+        working-directory: ${{ matrix.folder }}
+    env:
+      USE_BAZEL_VERSION: ${{ matrix.bazel }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}
+          repository-cache: true
+      - run: bazel build //...
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pre-commit/action@v3.0.1
   # For branch protection settings, this job provides a "stable" name that can be used to gate PR merges
   # on "all matrix jobs were successful".
diff --git a/.github/workflows/conventional-commits.yaml b/.github/workflows/conventional-commits.yaml
new file mode 100644
index 0000000..5ee66f4
--- /dev/null
+++ b/.github/workflows/conventional-commits.yaml
@@ -0,0 +1,20 @@
+# This helps the tag.yaml action to automatically create new releases
+#
+# tag.yaml requires all commits to follow the conventional commit pattern so that it can
+# automatically derive the next release version based on the commit history
+name: Verify PR title/description
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+permissions:
+  pull-requests: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index efe20c8..3a2300a 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,10 +20,17 @@ permissions:
   contents: write
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.3.0
+    # https://github.com/bazel-contrib/.github/blob/master/.github/workflows/release_ruleset.yaml
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
     with:
       release_files: rules_tensorrt_rtx-*.tar.gz
       prerelease: false
+      # Open the release as a draft to support immutable GitHub releases.
+      # Attestations will be uploaded to the draft in publish.yaml.
+      # See:
+      #   https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases.
+      #   https://github.com/bazel-contrib/publish-to-bcr#immutable-releases
+      draft: true
       tag_name: ${{ inputs.tag_name || github.ref_name }}
       bazel_test_command: "bazel build //..."
   publish:
@@ -33,3 +40,11 @@ jobs:
       tag_name: ${{ inputs.tag_name || github.ref_name }}
     secrets:
       publish_token: ${{ secrets.publish_token || secrets.BCR_PUBLISH_TOKEN }}
+  finalize:
+    # Publish the draft release
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        with:
+          tag_name: ${{ inputs.tag_name || github.ref_name }}
diff --git a/.github/workflows/release_prep.sh b/.github/workflows/release_prep.sh
index 2cec6e1..30cf2f9 100755
--- a/.github/workflows/release_prep.sh
+++ b/.github/workflows/release_prep.sh
@@ -16,25 +16,11 @@ git archive --format=tar --prefix=${PREFIX}/ ${TAG} | gzip > $ARCHIVE
 SHA=$(shasum -a 256 $ARCHIVE | awk '{print $1}')
 
 cat << EOF
-## Using Bzlmod with Bazel 6 or greater
+## Bzlmod
 
-1. (Bazel 6 only) Enable with \`common --enable_bzlmod\` in \`.bazelrc\`.
-2. Add to your \`MODULE.bazel\` file:
+Add to your \`MODULE.bazel\` file:
 
 \`\`\`starlark
 bazel_dep(name = "rules_tensorrt_rtx", version = "${TAG:1}")
 \`\`\`
-
-## Using WORKSPACE
-
-Paste this snippet into your \`WORKSPACE.bazel\` file:
-
-\`\`\`starlark
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
-http_archive(
-    name = "rules_tensorrt_rtx",
-    sha256 = "${SHA}",
-    strip_prefix = "${PREFIX}",
-    url = "https://github.com/wep21/rules_tensorrt_rtx/releases/download/${TAG}/${ARCHIVE}",
-)
 EOF
diff --git a/.github/workflows/tag.yaml b/.github/workflows/tag.yaml
index 5a15f77..0aa7422 100644
--- a/.github/workflows/tag.yaml
+++ b/.github/workflows/tag.yaml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       new-tag: ${{ steps.ccv.outputs.new-tag }}
-      new-tag-version: ${{steps.ccv.outputs.new-tag-version}}
-      new-tag-version-type: ${{steps.ccv.outputs.new-tag-version-type}}
-      recently-tagged: ${{steps.recent-tag.outputs.recently-tagged}}
+      new-tag-version: ${{ steps.ccv.outputs.new-tag-version }}
+      new-tag-version-type: ${{ steps.ccv.outputs.new-tag-version-type }}
+      recently-tagged: ${{ steps.recent-tag.outputs.recently-tagged }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Need enough history to find the prior release tag
           fetch-depth: 0
@@ -47,6 +47,7 @@ jobs:
           fi
       - name: Bump tag if necessary
         id: ccv
+        if: github.event_name != 'schedule' || steps.recent-tag.outputs.recently-tagged != 'true'
         uses: smlx/ccv@7318e2f25a52dcd550e75384b84983973251a1f8 # v0.10.0
   release:
     needs: tag
@@ -55,7 +56,7 @@ jobs:
       tag_name: ${{ needs.tag.outputs.new-tag-version }}
     secrets:
       publish_token: ${{ secrets.BCR_PUBLISH_TOKEN }}
-    if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major' && needs.tag.outputs.recently-tagged != 'true'
+    if: needs.tag.outputs.new-tag == 'true' && needs.tag.outputs.new-tag-version-type != 'major'
     permissions:
       contents: write
       id-token: write