diff --git a/.github/workflows/build-linux-bundle.yml b/.github/workflows/build-linux-bundle.yml
index d5584f35..e61300e3 100644
--- a/.github/workflows/build-linux-bundle.yml
+++ b/.github/workflows/build-linux-bundle.yml
@@ -1,9 +1,6 @@
-name: Build Linux Bundle
+name: "Build Linux Bundle"
 
 on:
-  push:
-    branches:
-      - master
   workflow_dispatch:
     inputs:
       push_to_cache:
@@ -11,6 +8,9 @@ on:
         required: false
         type: boolean
         default: false
+  push:
+    branches:
+      - master
 
 jobs:
   build:
@@ -18,16 +18,19 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
-      - name: Free disk space
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: 🗑 Free disk space
         run: sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
 
-      - name: Build Nix Package
+      - name: 📦 Build Nix package
         run: nix build --no-link --print-out-paths
 
-      - name: Push to Nix Cache
+      - name: 📤 Push to Nix cache
         if: github.ref == 'refs/heads/master' || inputs.push_to_cache == true
         env:
           NIX_CACHE_AUTH_TOKEN: ${{ secrets.NIX_CACHE_AUTH_TOKEN }}
@@ -35,23 +38,23 @@ jobs:
           nix run nixpkgs#cachix -- authtoken $NIX_CACHE_AUTH_TOKEN
           nix build --no-link --print-out-paths | nix run nixpkgs#cachix -- push graphite
 
-      - name: Build Linux Bundle
+      - name: 🏗 Build Linux bundle
         run: nix build .#graphite-bundle.tar.xz && cp ./result ./graphite-linux-bundle.tar.xz
 
-      - name: Upload Linux Bundle
+      - name: 📦 Upload Linux bundle
         uses: actions/upload-artifact@v4
         with:
           name: graphite-linux-bundle
           path: graphite-linux-bundle.tar.xz
           compression-level: 0
 
-      - name: Setup Flatpak Tooling
+      - name: 🔧 Install Flatpak tooling
         run: |
           sudo apt-get update
           sudo apt-get install -y flatpak flatpak-builder
           flatpak --user remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
 
-      - name: Build Flatpak
+      - name: 🏗 Build Flatpak
         run: |
           nix build .#graphite-flatpak-manifest
 
@@ -67,7 +70,7 @@ jobs:
 
           flatpak build-bundle repo Graphite.flatpak art.graphite.Graphite --runtime-repo=https://flathub.org/repo/flathub.flatpakrepo
 
-      - name: Upload Flatpak
+      - name: 📦 Upload Flatpak package
         uses: actions/upload-artifact@v4
         with:
           name: graphite-flatpak
diff --git a/.github/workflows/build-mac-bundle.yml b/.github/workflows/build-mac-bundle.yml
index b11eba79..681542e0 100644
--- a/.github/workflows/build-mac-bundle.yml
+++ b/.github/workflows/build-mac-bundle.yml
@@ -1,4 +1,4 @@
-name: Build Mac Bundle
+name: "Build Mac Bundle"
 
 on:
   workflow_dispatch: {}
@@ -14,10 +14,10 @@ jobs:
       WASM_BINDGEN_CLI_VERSION: "0.2.100"
 
     steps:
-      - name: Checkout
+      - name: 📥 Clone repository
         uses: actions/checkout@v4
 
-      - name: Setup Rust
+      - name: 🦀 Install Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: stable
@@ -25,7 +25,7 @@ jobs:
           rustflags: ""
           target: wasm32-unknown-unknown
 
-      - name: Cache Cargo
+      - name: 💾 Set up Cargo cache
         uses: actions/cache@v4
         with:
           path: |
@@ -34,7 +34,7 @@ jobs:
             target
           key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
 
-      - name: Setup Node
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
@@ -43,7 +43,7 @@ jobs:
             package-lock.json
             frontend/package-lock.json
 
-      - name: Install Native Dependencies
+      - name: 🚧 Install native dependencies
         env:
           GITHUB_TOKEN: ${{ github.token }}
           BINSTALL_DISABLE_TELEMETRY: "true"
@@ -64,25 +64,26 @@ jobs:
           cargo binstall --no-confirm --force cargo-about
           cargo binstall --no-confirm --force "wasm-bindgen-cli@${WASM_BINDGEN_CLI_VERSION}"
 
-      - name: Build Mac Bundle
+      - name: 🏗 Build Mac bundle
         env:
           CARGO_TERM_COLOR: always
         run: cargo run build desktop
 
-      - name: Stage Artifacts
+      - name: 📁 Stage artifacts
         shell: bash
         run: |
           rm -rf target/artifacts
           mkdir -p target/artifacts
           cp -R target/release/Graphite.app target/artifacts/Graphite.app
 
-      - name: Upload Mac Bundle
+      - name: 📦 Upload Mac bundle
+        if: github.ref != 'refs/heads/master'
         uses: actions/upload-artifact@v4
         with:
           name: graphite-mac-bundle
           path: target/artifacts
 
-      - name: Sign and Notarize Mac Bundle Preparation
+      - name: 🔏 Sign and notarize (preparation)
         if: github.ref == 'refs/heads/master'
         env:
           APPLE_CERT_BASE64: ${{ secrets.APPLE_CERT_BASE64 }}
@@ -116,7 +117,7 @@ jobs:
           </plist>
           EOF
 
-      - name: Sign and Notarize Mac Bundle
+      - name: 🔏 Sign and notarize
         if: github.ref == 'refs/heads/master'
         env:
           APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }}
@@ -149,7 +150,7 @@ jobs:
 
           spctl -a -vv "$APP_PATH"
 
-      - name: Upload Mac Bundle Signed
+      - name: 📦 Upload signed Mac bundle
         if: github.ref == 'refs/heads/master'
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/build-nix-package.yml b/.github/workflows/build-nix-package.yml
index 45669d03..2f2295a9 100644
--- a/.github/workflows/build-nix-package.yml
+++ b/.github/workflows/build-nix-package.yml
@@ -1,4 +1,4 @@
-name: Build Nix Package
+name: "Build Nix Package"
 
 on:
   workflow_dispatch: {}
@@ -9,9 +9,14 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
-      - name: Build Nix Package Dev
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: 💾 Set up Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: 📦 Build Nix package dev
         run: nix build .#graphite-dev --print-build-logs
diff --git a/.github/workflows/build-production.yml b/.github/workflows/build-production.yml
index eae2aca9..d9a186e2 100644
--- a/.github/workflows/build-production.yml
+++ b/.github/workflows/build-production.yml
@@ -21,29 +21,29 @@ jobs:
       INDEX_HTML_HEAD_REPLACEMENT: <script defer data-domain="editor.graphite.art" data-api="https://graphite.art/visit/event" src="https://graphite.art/visit/script.hash.js"></script>
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🗑 Clear wasm-bindgen cache
         run: rm -r ~/.cache/.wasm-pack
 
-      - name: 🟢 Install the latest Node.js
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "latest"
+          node-version-file: .nvmrc
 
       - name: 🚧 Install build dependencies
         run: |
           cd frontend
           npm run setup
 
-      - name: 🦀 Install the latest Rust
-        run: |
-          echo "Initial system version:"
-          rustc --version
-          rustup update stable
-          echo "Latest updated version:"
-          rustc --version
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
+          target: wasm32-unknown-unknown
 
       - name: ✂ Replace template in <head> of index.html
         run: |
@@ -55,15 +55,11 @@ jobs:
         run: mold -run cargo run build web
 
       - name: 📤 Publish to Cloudflare Pages
-        id: cloudflare
-        uses: cloudflare/pages-action@1
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          projectName: graphite-editor
-          directory: frontend/dist
-          branch: master
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          npx wrangler@3 pages deploy "frontend/dist" --project-name="graphite-editor" --branch="master" --commit-dirty=true
 
       - name: 📦 Upload assets to GitHub release
         env:
diff --git a/.github/workflows/deploy-master.yml b/.github/workflows/build-web-bundle.yml
similarity index 61%
rename from .github/workflows/deploy-master.yml
rename to .github/workflows/build-web-bundle.yml
index bf6c280b..bde9beff 100644
--- a/.github/workflows/deploy-master.yml
+++ b/.github/workflows/build-web-bundle.yml
@@ -1,6 +1,7 @@
-name: "Deploy Master"
+name: "Build Web Bundle"
 
 on:
+  workflow_dispatch: {}
   push:
     branches:
       - master
@@ -10,7 +11,7 @@ env:
   INDEX_HTML_HEAD_REPLACEMENT: <script defer data-domain="dev.graphite.art" data-api="https://graphite.art/visit/event" src="https://graphite.art/visit/script.hash.js"></script>
 
 jobs:
-  deploy:
+  build:
     runs-on: [self-hosted, target/wasm]
     permissions:
       contents: write
@@ -22,25 +23,29 @@ jobs:
       SCCACHE_DIR: /var/lib/github-actions/.cache
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🗑 Clear wasm-bindgen cache
         run: rm -r ~/.cache/.wasm-pack || true
 
-      - name: 🟢 Install the latest Node.js
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "latest"
+          node-version-file: .nvmrc
 
       - name: 🚧 Install build dependencies
         run: |
           cd frontend
           npm run setup
 
-      - name: 🦀 Install the latest Rust
-        run: |
-          rustup update stable
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
+          target: wasm32-unknown-unknown
 
       - name: ✂ Replace template in <head> of index.html
         run: |
@@ -53,26 +58,57 @@ jobs:
 
       - name: 📤 Publish to Cloudflare Pages
         id: cloudflare
-        uses: cloudflare/pages-action@1
-        continue-on-error: true
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          projectName: graphite-dev
-          directory: frontend/dist
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          MAX_ATTEMPTS=5
+          DELAY=30
+          for ATTEMPT in $(seq 1 $MAX_ATTEMPTS); do
+            echo "Attempt $ATTEMPT of $MAX_ATTEMPTS..."
+            if OUTPUT=$(npx wrangler@3 pages deploy "frontend/dist" --project-name="graphite-dev" --commit-dirty=true 2>&1); then
+              URL=$(echo "$OUTPUT" | grep -oP 'https://[^\s]+\.pages\.dev' | tail -1)
+              echo "url=$URL" >> "$GITHUB_OUTPUT"
+              echo "Published successfully: $URL"
+              exit 0
+            fi
+            echo "Attempt $ATTEMPT failed:"
+            echo "$OUTPUT"
+            if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+              echo "Retrying in ${DELAY}s..."
+              sleep $DELAY
+              DELAY=$((DELAY * 3))
+            fi
+          done
+          echo "All $MAX_ATTEMPTS Cloudflare Pages publish attempts failed."
+          exit 1
 
       - name: 💬 Comment build link URL to commit hash page on GitHub
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CF_URL: ${{ steps.cloudflare.outputs.url }}
         run: |
+          if [ -z "$CF_URL" ]; then
+            echo "No Cloudflare URL available, skipping comment."
+            exit 1
+          fi
           gh api \
             -X POST \
             -H "Accept: application/vnd.github+json" \
             /repos/${{ github.repository }}/commits/$(git rev-parse HEAD)/comments \
             -f body="| 📦 **Build Complete for** $(git rev-parse HEAD) |
           |-|
-          | ${{ steps.cloudflare.outputs.url }} |"
+          | $CF_URL |"
+
+      - name: ✂ Strip analytics script from built output for clean artifact
+        run: |
+          sed -i "s|$INDEX_HTML_HEAD_REPLACEMENT||" frontend/dist/index.html
+
+      - name: 📦 Upload web bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: graphite-web-bundle
+          path: frontend/dist
 
       - name: 📃 Generate code documentation info for website
         run: |
@@ -84,7 +120,7 @@ jobs:
 
       - name: 💿 Obtain cache of auto-generated code docs artifacts, to check if they've changed
         id: cache-website-code-docs
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: artifacts
           key: website-code-docs
@@ -105,7 +141,7 @@ jobs:
 
       - name: 💾 Save cache of auto-generated code docs artifacts
         if: steps.website-code-docs-changed.outputs.changed == 'true'
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@v4
         with:
           path: artifacts
           key: ${{ steps.cache-website-code-docs.outputs.cache-primary-key }}
diff --git a/.github/workflows/build-win-bundle.yml b/.github/workflows/build-windows-bundle.yml
similarity index 89%
rename from .github/workflows/build-win-bundle.yml
rename to .github/workflows/build-windows-bundle.yml
index 720bdb63..8402b094 100644
--- a/.github/workflows/build-win-bundle.yml
+++ b/.github/workflows/build-windows-bundle.yml
@@ -1,4 +1,4 @@
-name: Build Windows Bundle
+name: "Build Windows Bundle"
 
 on:
   workflow_dispatch: {}
@@ -6,22 +6,21 @@ on:
     branches:
       - master
 
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   build:
     runs-on: windows-latest
+    permissions:
+      contents: read
+      id-token: write
 
     env:
       WASM_BINDGEN_CLI_VERSION: "0.2.100"
 
     steps:
-      - name: Checkout
+      - name: 📥 Clone repository
         uses: actions/checkout@v4
 
-      - name: Setup Rust
+      - name: 🦀 Install Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: stable
@@ -29,7 +28,7 @@ jobs:
           rustflags: ""
           target: wasm32-unknown-unknown
 
-      - name: Cache Cargo
+      - name: 💾 Set up Cargo cache
         uses: actions/cache@v4
         with:
           path: |
@@ -38,7 +37,7 @@ jobs:
             target
           key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
 
-      - name: Setup Node
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
@@ -47,10 +46,10 @@ jobs:
             package-lock.json
             frontend/package-lock.json
 
-      - name: Setup Cargo Binstall
+      - name: 📦 Install Cargo-binstall
         uses: cargo-bins/cargo-binstall@main
 
-      - name: Install Native Dependencies
+      - name: 🚧 Install native dependencies
         shell: pwsh
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -69,26 +68,27 @@ jobs:
           cargo binstall --no-confirm --force cargo-about
           cargo binstall --no-confirm --force "wasm-bindgen-cli@$env:WASM_BINDGEN_CLI_VERSION"
 
-      - name: Build Windows Bundle
+      - name: 🏗 Build Windows bundle
         shell: bash # `cargo-about` refuses to run in powershell
         env:
           CARGO_TERM_COLOR: always
         run: cargo run build desktop
 
-      - name: Stage Artifacts
+      - name: 📁 Stage artifacts
         shell: bash
         run: |
           rm -rf target/artifacts
           mkdir -p target/artifacts
           cp -R target/release/Graphite target/artifacts/Graphite
 
-      - name: Upload Windows Bundle
+      - name: 📦 Upload Windows bundle
+        if: github.ref != 'refs/heads/master'
         uses: actions/upload-artifact@v4
         with:
           name: graphite-windows-bundle
           path: target/artifacts
 
-      - name: Azure login
+      - name: 🔑 Azure login
         if: github.ref == 'refs/heads/master'
         uses: azure/login@v1
         with:
@@ -97,7 +97,7 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
           enable-AzPSSession: true
 
-      - name: Sign
+      - name: 🔏 Sign
         if: github.ref == 'refs/heads/master'
         uses: azure/artifact-signing-action@v1
         with:
@@ -118,7 +118,7 @@ jobs:
           timestamp-digest: SHA256
           correlation-id: ${{ github.sha }}
 
-      - name: Verify Signatures
+      - name: ✅ Verify signatures
         if: github.ref == 'refs/heads/master'
         shell: pwsh
         run: |
@@ -165,7 +165,7 @@ jobs:
                   Out-File $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
           }
 
-      - name: Upload Windows Bundle Signed
+      - name: 📦 Upload signed Windows bundle
         if: github.ref == 'refs/heads/master'
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/cargo-deny.yml b/.github/workflows/cargo-deny.yml
index 4710c155..e49d3ffb 100644
--- a/.github/workflows/cargo-deny.yml
+++ b/.github/workflows/cargo-deny.yml
@@ -1,9 +1,9 @@
 name: "Audit Security Advisories"
 
 on:
-  # Run once each day
+  # Run once each week
   schedule:
-    - cron: "0 0 * * *"
+    - cron: "0 0 * * 0"
 
 jobs:
   cargo-deny:
@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🔒 Check crate security advisories for root workspace
         uses: EmbarkStudios/cargo-deny-action@v2
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51a8feed..8410b6b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,17 +12,20 @@ jobs:
   rust-fmt:
     runs-on: ubuntu-latest
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🚦 Check if CI can be skipped
         id: skip-check
         uses: cariad-tech/merge-queue-ci-skipper@main
 
-      - name: 🦀 Install the latest Rust
+      - name: 🦀 Install Rust
         if: steps.skip-check.outputs.skip-check != 'true'
-        uses: dtolnay/rust-toolchain@stable
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
+          toolchain: stable
+          override: true
+          rustflags: ""
           components: rustfmt
 
       - name: 🔬 Check Rust formatting
@@ -33,8 +36,8 @@ jobs:
   cargo-deny:
     runs-on: ubuntu-latest
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 📜 Check crate license compatibility for root workspace
         uses: EmbarkStudios/cargo-deny-action@v2
@@ -61,8 +64,8 @@ jobs:
       SCCACHE_DIR: /var/lib/github-actions/.cache
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🚦 Check if CI can be skipped
         id: skip-check
@@ -72,11 +75,11 @@ jobs:
         if: steps.skip-check.outputs.skip-check != 'true'
         run: rm -r ~/.cache/.wasm-pack || true
 
-      - name: 🟢 Install the latest Node.js
+      - name: 🟢 Install Node.js
         if: steps.skip-check.outputs.skip-check != 'true'
         uses: actions/setup-node@v4
         with:
-          node-version: "latest"
+          node-version-file: .nvmrc
 
       - name: 🚧 Install build dependencies
         if: steps.skip-check.outputs.skip-check != 'true'
@@ -84,10 +87,14 @@ jobs:
           cd frontend
           npm run setup
 
-      - name: 🦀 Install the latest Rust
+      - name: 🦀 Install Rust
         if: steps.skip-check.outputs.skip-check != 'true'
-        run: |
-          rustup update stable
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
+          target: wasm32-unknown-unknown
 
       - name: 🦀 Fetch Rust dependencies
         if: steps.skip-check.outputs.skip-check != 'true'
@@ -102,14 +109,12 @@ jobs:
 
       - name: 📤 Publish to Cloudflare Pages
         if: steps.skip-check.outputs.skip-check != 'true'
-        uses: cloudflare/pages-action@1
         continue-on-error: true
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          projectName: graphite-dev
-          directory: frontend/dist
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          npx wrangler@3 pages deploy "frontend/dist" --project-name="graphite-dev" --commit-dirty=true
 
       - name: 👕 Lint Graphite web formatting
         if: steps.skip-check.outputs.skip-check != 'true'
@@ -128,17 +133,20 @@ jobs:
       SCCACHE_DIR: /var/lib/github-actions/.cache
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
       - name: 🚦 Check if CI can be skipped
         id: skip-check
         uses: cariad-tech/merge-queue-ci-skipper@main
 
-      - name: 🦀 Install the latest Rust
+      - name: 🦀 Install Rust
         if: steps.skip-check.outputs.skip-check != 'true'
-        run: |
-          rustup update stable
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
 
       - name: 🦀 Fetch Rust dependencies
         if: steps.skip-check.outputs.skip-check != 'true'
diff --git a/.github/workflows/comment-!build-commands.yml b/.github/workflows/comment-!build-commands.yml
index 0224b722..9b7a5a18 100644
--- a/.github/workflows/comment-!build-commands.yml
+++ b/.github/workflows/comment-!build-commands.yml
@@ -43,8 +43,8 @@ jobs:
           echo "ref=$REF" >> $GITHUB_OUTPUT
           echo "sha=$SHA" >> $GITHUB_OUTPUT
 
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
         with:
           repository: ${{ steps.commit_info.outputs.repo }}
           ref: ${{ steps.commit_info.outputs.ref }}
@@ -53,23 +53,23 @@ jobs:
         continue-on-error: true
         run: rm -r ~/.cache/.wasm-pack
 
-      - name: 🟢 Install the latest Node.js
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "latest"
+          node-version-file: .nvmrc
 
       - name: 🚧 Install build dependencies
         run: |
           cd frontend
           npm run setup
 
-      - name: 🦀 Install the latest Rust
-        run: |
-          echo "Initial system version:"
-          rustc --version
-          rustup update stable
-          echo "Latest updated version:"
-          rustc --version
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
+          target: wasm32-unknown-unknown
 
       - name: ✂ Replace template in <head> of index.html
         env:
@@ -121,14 +121,18 @@ jobs:
 
       - name: 📤 Publish to Cloudflare Pages
         id: cloudflare
-        uses: cloudflare/pages-action@1
-        continue-on-error: true
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          projectName: graphite-dev
-          directory: frontend/dist
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          if OUTPUT=$(npx wrangler@3 pages deploy "frontend/dist" --project-name="graphite-dev" --commit-dirty=true 2>&1); then
+            URL=$(echo "$OUTPUT" | grep -oP 'https://[^\s]+\.pages\.dev' | tail -1)
+            echo "url=$URL" >> "$GITHUB_OUTPUT"
+            echo "Published successfully: $URL"
+          else
+            echo "$OUTPUT"
+            exit 1
+          fi
 
       - name: ❗ Warn on publish failure
         if: ${{ failure() }}
@@ -139,7 +143,7 @@ jobs:
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: 'The deployment to Cloudflare Pages has failed. Please check the [build logs](https://github.com/GraphiteEditor/Graphite/actions/runs/' + context.runId + ') for details.
+              body: 'The deployment to Cloudflare Pages has failed. Please check the [build logs](https://github.com/GraphiteEditor/Graphite/actions/runs/' + context.runId + ') for details.'
             });
 
       - name: 💬 Comment build link
diff --git a/.github/workflows/comment-clippy-warnings.yaml b/.github/workflows/comment-clippy-warnings.yaml
index 1c02e88f..d9e2ff68 100644
--- a/.github/workflows/comment-clippy-warnings.yaml
+++ b/.github/workflows/comment-clippy-warnings.yaml
@@ -1,4 +1,4 @@
-name: Clippy Check
+name: "Clippy Check"
 
 on:
   pull_request:
diff --git a/.github/workflows/comment-profiling-changes.yaml b/.github/workflows/comment-profiling-changes.yaml
index 70877a5e..3369f4e6 100644
--- a/.github/workflows/comment-profiling-changes.yaml
+++ b/.github/workflows/comment-profiling-changes.yaml
@@ -1,4 +1,4 @@
-name: Profiling Changes
+name: "Profiling Changes"
 
 on:
   pull_request:
diff --git a/.github/workflows/library-rawkit.yml b/.github/workflows/library-rawkit.yml
index 569d5965..5d5b8bf6 100644
--- a/.github/workflows/library-rawkit.yml
+++ b/.github/workflows/library-rawkit.yml
@@ -25,16 +25,15 @@ jobs:
       SCCACHE_DIR: /var/lib/github-actions/.cache
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
-      - name: 🦀 Install the latest Rust
-        run: |
-          echo "Initial system version:"
-          rustc --version
-          rustup update stable
-          echo "Latest updated version:"
-          rustc --version
+      - name: 🦀 Install Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          override: true
+          rustflags: ""
 
       - name: 📦 Run sccache-cache
         uses: mozilla-actions/sccache-action@v0.0.6
diff --git a/.github/workflows/provide-shaders.yml b/.github/workflows/provide-shaders.yml
index b6006a7b..84f75311 100644
--- a/.github/workflows/provide-shaders.yml
+++ b/.github/workflows/provide-shaders.yml
@@ -1,4 +1,4 @@
-name: Provide Shaders
+name: "Provide Shaders"
 
 on:
   push:
@@ -12,14 +12,19 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@main
-      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
-      - name: Build graphene raster nodes shaders
+      - name: ❄ Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: 💾 Set up Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: 🏗 Build graphene raster nodes shaders
         run: nix build .#graphite-raster-nodes-shaders && cp result raster_nodes_shaders_entrypoint.wgsl
 
-      - name: Upload graphene raster nodes shaders to artifacts repository
+      - name: 📤 Upload graphene raster nodes shaders to artifacts repository
         run: |
           bash .github/workflows/scripts/artifact-upload.bash \
             ${{ vars.ARTIFACTS_REPO_OWNER }} \
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
index e4bb6d1a..fae935b4 100644
--- a/.github/workflows/website.yml
+++ b/.github/workflows/website.yml
@@ -1,6 +1,7 @@
 name: "Website"
 
 on:
+  workflow_dispatch: {}
   push:
     branches:
       - master
@@ -9,7 +10,6 @@ on:
   pull_request:
     paths:
       - website/**
-  workflow_dispatch: {}
 env:
   CARGO_TERM_COLOR: always
   INDEX_HTML_HEAD_INCLUSION: <script defer data-domain="graphite.art" data-api="/visit/event" src="/visit/script.hash.js"></script>
@@ -23,16 +23,13 @@ jobs:
       pull-requests: write
 
     steps:
-      - name: 📥 Clone and checkout repository
-        uses: actions/checkout@v3
+      - name: 📥 Clone repository
+        uses: actions/checkout@v4
 
-      # We can remove this step once `ubuntu-latest` has Node.js 22 or newer for its native TypeScript support. See:
-      # https://github.com/actions/runner-images?tab=readme-ov-file#available-images
-      # https://nodejs.org/en/learn/typescript/run-natively
-      - name: 📦 Install the latest Node.js
+      - name: 🟢 Install Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "latest"
+          node-version-file: .nvmrc
 
       - name: 🕸 Install Zola
         uses: taiki-e/install-action@v2
@@ -54,7 +51,7 @@ jobs:
 
       - name: 💿 Obtain cache of auto-generated code docs artifacts
         id: cache-website-code-docs
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: artifacts
           key: website-code-docs
@@ -98,12 +95,9 @@ jobs:
           zola --config config.toml build --minify
 
       - name: 📤 Publish to Cloudflare Pages
-        id: cloudflare
-        uses: cloudflare/pages-action@1
         continue-on-error: true
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
-          projectName: graphite-website
-          directory: website/public
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          npx wrangler@3 pages deploy "website/public" --project-name="graphite-website" --commit-dirty=true
diff --git a/.nvmrc b/.nvmrc
index 209e3ef4..a45fd52c 100644
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +1 @@
-20
+24