diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 00000000..101b84c6
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,101 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# Granted per job rather than here, because the called workflows need scopes this one
+# does not, and a called workflow can never hold more than its caller.
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  prepare:
+    name: Determine image tag
+    runs-on: ubuntu-latest
+    # Prevent execution on forks, which have no access to the registry secrets
+    if: github.repository_owner == 'iExecBlockchainComputing'
+    permissions:
+      contents: read # actions/checkout
+    outputs:
+      image_tag: ${{ steps.rules.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Apply branch and image tag rules
+        id: rules
+        env:
+          BRANCH: ${{ github.head_ref || github.ref_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          short_sha=$(echo "$HEAD_SHA" | cut -c1-8)
+
+          # Production branches get dev-<sha> images, feature branches feature-<sha>.
+          # Release-please branches build no image: their code is covered by the
+          # dev-<sha> image CI builds on the merge to main, and promote-image.yaml
+          # promotes that image to the vX.Y.Z tag.
+          case "$BRANCH" in
+            main)              echo "image_tag=dev-${short_sha}" | tee -a "$GITHUB_OUTPUT" ;;
+            feat/*|fix/*)      echo "image_tag=feature-${short_sha}" | tee -a "$GITHUB_OUTPUT" ;;
+            release-please--*) : ;;
+            *)
+              echo "❌ Branch does not respect naming rules: $BRANCH"
+              echo "Expected one of: main, feat/*, fix/*, release-please--*"
+              exit 1
+              ;;
+          esac
+
+  build-and-test:
+    name: Build, test and analyse
+    needs: prepare
+    permissions:
+      contents: read # actions/checkout
+      actions: write # actions/upload-artifact
+    # java-build-v1.0.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/java-build.yml@230e504041b25d1e45dad1651ac29a9b9f827dd5
+    with:
+      java-version: '21'
+      sonar: true
+      dockerhub-login: true
+      upload-jar: true
+      artifact-name: boot-jar
+    secrets:
+      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }}
+      sonar-token: ${{ secrets.SONAR_TOKEN }}
+
+  build-image:
+    name: Build and push OCI image
+    needs: [prepare, build-and-test]
+    if: needs.prepare.outputs.image_tag != ''
+    permissions:
+      contents: read # actions/checkout
+      actions: write # actions/download-artifact + actions/upload-artifact (docker-image-tag)
+      security-events: write # codeql-action/upload-sarif, Trivy report on pull requests
+      pull-requests: write # peter-evans/create-or-update-comment, Hadolint report on pull requests
+    # docker-build-v3.7.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-build.yml@fc54a889aaabffc2acf96451d54592a90d068af9
+    with:
+      image-name: docker-regis.iex.ec/iexec-core
+      image-tag: ${{ needs.prepare.outputs.image_tag }}
+      registry: docker-regis.iex.ec
+      push: true
+      security-scan: false
+      security-report: 'sarif'
+      hadolint: true
+      platform: linux/amd64
+      artifact-name: ${{ needs.build-and-test.outputs.artifact-name }}
+      artifact-path: build/libs
+      build-args: jar=${{ needs.build-and-test.outputs.jar-path }}
+    secrets:
+      dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+      dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN_PULL_ONLY }}
+      username: ${{ secrets.NEXUS_USERNAME }}
+      password: ${{ secrets.NEXUS_PASSWORD }}
diff --git a/.github/workflows/promote-image.yaml b/.github/workflows/promote-image.yaml
new file mode 100644
index 00000000..b0bf9fc3
--- /dev/null
+++ b/.github/workflows/promote-image.yaml
@@ -0,0 +1,37 @@
+name: Promote Image
+
+# Releasing does not rebuild anything. The image CI already built, tested and scanned
+# for this commit is promoted to the release tag by copying its manifest, so the
+# released artifact is byte for byte the one that passed the pipeline. A rebuild would
+# not be equivalent: the Dockerfile runs `apt-get upgrade`, so the same source produces
+# a different image whenever Ubuntu has moved on.
+# The promotion itself is delegated to the docker-promote reusable workflow.
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions: {}
+
+concurrency:
+  group: promote-image-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  promote-image:
+    name: Promote the tested image to the release tag
+    # Prevent execution on forks, which have no access to the registry secrets
+    if: github.repository_owner == 'iExecBlockchainComputing'
+    permissions:
+      contents: read
+      actions: read # look up the CI run that built the tagged commit
+    # docker-promote-v1.0.0
+    uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/docker-promote.yml@23f97c518d217113e299e7c6a870a41422cd2163
+    with:
+      image-name: docker-regis.iex.ec/iexec-core
+      registry: docker-regis.iex.ec
+      security-scan: false
+    secrets:
+      username: ${{ secrets.NEXUS_USERNAME }}
+      password: ${{ secrets.NEXUS_PASSWORD }}
diff --git a/Jenkinsfile b/Jenkinsfile
deleted file mode 100644
index c09c58e1..00000000
--- a/Jenkinsfile
+++ /dev/null
@@ -1,4 +0,0 @@
-@Library('global-jenkins-library@support/2.7.4') _
-buildJavaProject(
-        shouldPublishJars: false,
-        shouldPublishDockerImages: true)
diff --git a/build.gradle b/build.gradle
index 06e6a2b5..a097794b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,7 +1,7 @@
 plugins {
     id 'java'
     id 'io.freefair.lombok' version '8.14.4'
-    id 'org.springframework.boot' version '3.5.8'
+    id 'org.springframework.boot' version '3.5.16'
     id 'io.spring.dependency-management' version '1.1.7'
     id 'jacoco'
     id 'org.sonarqube' version '6.3.1.5724'
@@ -16,10 +16,7 @@ ext {
 }
 
 allprojects {
-    group = 'com.iexec.core'
-    if (gitTag.isEmpty()) {
-        version += '-NEXT-SNAPSHOT'
-    }
+    group = 'com.github.iExecBlockchainComputing'
     repositories {
         mavenLocal()
         mavenCentral()
@@ -46,11 +43,11 @@ dependencyManagement {
 
 dependencies {
     // iexec
-    implementation "com.github.iexecblockchaincomputing:iexec-commons-poco:$iexecCommonsPocoVersion"
-    implementation "com.github.iexecblockchaincomputing:iexec-common:$iexecCommonVersion"
-    implementation "com.github.iexecblockchaincomputing.iexec-blockchain-adapter-api:iexec-blockchain-adapter-api-library:$iexecBlockchainAdapterVersion"
-    implementation "com.github.iexecblockchaincomputing.iexec-result-proxy:iexec-result-proxy-library:$iexecResultVersion"
-    implementation "com.github.iexecblockchaincomputing.iexec-sms:iexec-sms-library:$iexecSmsVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-commons-poco:$iexecCommonsPocoVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-common:$iexecCommonVersion"
+    implementation "com.github.iExecBlockchainComputing.iexec-blockchain-adapter-api:iexec-blockchain-adapter-api-library:$iexecBlockchainAdapterVersion"
+    implementation "com.github.iExecBlockchainComputing.iexec-result-proxy:iexec-result-proxy-library:$iexecResultVersion"
+    implementation "com.github.iExecBlockchainComputing.iexec-sms:iexec-sms-library:$iexecSmsVersion"
     implementation project(':iexec-core-library')
     implementation project(':iexec-task-api')
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 580ce03f..04e7acad 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,7 +1,7 @@
 services:
 
   chain:
-    image: docker-regis.iex.ec/poco-chain:1.2.2-poco-v6.2.0-contracts-nethermind
+    image: iexechub/poco-chain:1.2.2-poco-v6.2.0-contracts-nethermind
     expose:
       - "8545"
 
diff --git a/gradle.properties b/gradle.properties
index 1245b31f..8d6d6a32 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,10 +1,10 @@
 # x-release-please-start-version
 version=9.4.0
 # x-release-please-end
-iexecCommonsPocoVersion=5.5.0
-iexecCommonVersion=9.3.0
-iexecBlockchainAdapterVersion=9.1.0
-iexecResultVersion=9.2.0
-iexecSmsVersion=9.4.0
+iexecCommonsPocoVersion=5.5.1
+iexecCommonVersion=9.3.1
+iexecBlockchainAdapterVersion=9.1.1
+iexecResultVersion=9.2.1
+iexecSmsVersion=9.4.1
 mvnRepositoryUsername
 mvnRepositoryPassword
diff --git a/iexec-core-library/build.gradle b/iexec-core-library/build.gradle
index 8e10f773..85813b67 100644
--- a/iexec-core-library/build.gradle
+++ b/iexec-core-library/build.gradle
@@ -5,11 +5,13 @@ plugins {
     id 'maven-publish'
 }
 
+group = 'com.github.iExecBlockchainComputing.iexec-core'
+
 dependencies {
-    implementation platform("org.springframework.boot:spring-boot-dependencies:3.5.8")
+    implementation platform("org.springframework.boot:spring-boot-dependencies:3.5.16")
 
-    implementation "com.github.iexecblockchaincomputing:iexec-commons-poco:$iexecCommonsPocoVersion"
-    implementation "com.github.iexecblockchaincomputing:iexec-common:$iexecCommonVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-commons-poco:$iexecCommonsPocoVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-common:$iexecCommonVersion"
 }
 
 java {
diff --git a/iexec-task-api/build.gradle b/iexec-task-api/build.gradle
index 3e834632..77ebe5eb 100644
--- a/iexec-task-api/build.gradle
+++ b/iexec-task-api/build.gradle
@@ -5,11 +5,13 @@ plugins {
     id 'maven-publish'
 }
 
+group = 'com.github.iExecBlockchainComputing.iexec-core'
+
 dependencies {
-    implementation platform("org.springframework.boot:spring-boot-dependencies:3.5.8")
+    implementation platform("org.springframework.boot:spring-boot-dependencies:3.5.16")
 
-    implementation "com.github.iexecblockchaincomputing:iexec-commons-poco:$iexecCommonsPocoVersion"
-    implementation "com.github.iexecblockchaincomputing:iexec-common:$iexecCommonVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-commons-poco:$iexecCommonsPocoVersion"
+    implementation "com.github.iExecBlockchainComputing:iexec-common:$iexecCommonVersion"
 }
 
 java {
diff --git a/release-please-config.json b/release-please-config.json
index 73248fb3..9179368d 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -1,5 +1,6 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "always-update": true,
   "draft-pull-request": true,
   "include-component-in-tag": false,
   "include-v-in-tag": true,