diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index ed0ea74..88f820b 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -12,14 +12,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24.x'
+          cache: npm
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - name: Setup Pages
         uses: actions/configure-pages@v5
       - run: npm ci
       - name: Build docs
         run: npm run docs
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./docs/build
 
@@ -36,4 +41,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0ba283b..2d63dad 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,18 +12,19 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
           cache: npm
-      - uses: microbit-foundation/npm-package-versioner-action@v1
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
+      - uses: microbit-foundation/npm-package-versioner-action@v3
       - run: npm ci
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - run: npm run ci
-      - run: npm publish
+      - run: npm publish --allow-directory=all
         if: github.event_name == 'release' && github.event.action == 'created'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.node-version b/.node-version
new file mode 100644
index 0000000..7329493
--- /dev/null
+++ b/.node-version
@@ -0,0 +1 @@
+24.18.0
\ No newline at end of file
diff --git a/.npmrc b/.npmrc
index 94a06c2..e114aba 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,15 @@
 access=public
+
+min-release-age=7
+min-release-age-exclude[]=@microbit/*
+min-release-age-exclude[]=@microbit-foundation/*
+
+# root here means this project's package.json
+allow-git=root
+allow-remote=root
+allow-file=root
+allow-directory=root
+
+strict-allow-scripts=true
+
+engine-strict=true
\ No newline at end of file
diff --git a/.storybook/main.ts b/.storybook/main.ts
index f90e437..f2b17d1 100644
--- a/.storybook/main.ts
+++ b/.storybook/main.ts
@@ -2,6 +2,7 @@ import type { StorybookConfig } from '@storybook/react-vite';
 
 const config: StorybookConfig = {
   stories: ['../src/**/*.stories.tsx'],
+  staticDirs: ['../public'],
   addons: [
     '@storybook/addon-links',
     '@storybook/addon-essentials',
diff --git a/package-lock.json b/package-lock.json
index f00d4b2..18474f2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -36,10 +36,6 @@
         "tslib": "^2.6.2",
         "typescript": "^5.2.2"
       },
-      "engines": {
-        "node": ">=20",
-        "npm": ">=10"
-      },
       "peerDependencies": {
         "react": ">=18.0.0",
         "react-dom": ">=18.0.0"
diff --git a/package.json b/package.json
index 082bddc..8a312d3 100644
--- a/package.json
+++ b/package.json
@@ -11,10 +11,11 @@
     "type": "git",
     "url": "https://github.com/microbit-foundation/python-editor-embed"
   },
-  "engines": {
-    "node": ">=20",
-    "npm": ">=10"
+  "allowScripts": {
+    "fsevents": true,
+    "esbuild": true
   },
+  "packageManager": "npm@11.18.0",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
   "typings": "./dist/esm/index.d.ts",
diff --git a/public/_headers b/public/_headers
new file mode 100644
index 0000000..5f909cb
--- /dev/null
+++ b/public/_headers
@@ -0,0 +1,11 @@
+# Never serve a stale HTML entry point: it references content-hashed assets
+# that are purged on redeploy, which otherwise 404 -> SPA fallback -> a
+# text/html response the browser rejects as a module script.
+/index.html
+  Cache-Control: no-cache
+/iframe.html
+  Cache-Control: no-cache
+
+# Content-hashed assets are immutable and safe to cache forever.
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable