diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 53ca1a2..00eb9e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,12 +8,14 @@
 #     smoke test: Fortran + MPI + NetCDF-4 compiled and run in the sandbox), nixpkgs-fmt,
 #     statix, deadnix, shellcheck, justfile parse, and the scripts' own self-tests. devShells
 #     are evaluated, not built, so ai-jail (a Rust compile) and ParMETIS never build here.
+#
+# No run on pull requests, to save runner time: the gate runs after the merge, on main.
+# labs/ptbr-pdf compiles Typst from source, so it runs only on workflow_dispatch.
 name: ci
 
 on:
   push:
     branches: [main]
-  pull_request:
   workflow_dispatch:
 
 concurrency:
@@ -39,7 +41,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        lab: [pratico, publisher, ptbr-pdf, lint, paper, gleam-website, agentic, cuda, present, viz]
+        lab: ${{ fromJSON(github.event_name == 'workflow_dispatch'
+          && '["pratico", "publisher", "ptbr-pdf", "lint", "paper", "gleam-website", "agentic", "cuda", "present", "viz"]'
+          || '["pratico", "publisher", "lint", "paper", "gleam-website", "agentic", "cuda", "present", "viz"]') }}
     defaults:
       run:
         working-directory: labs/${{ matrix.lab }}
diff --git a/.github/workflows/citation.yml b/.github/workflows/citation.yml
index 5b17156..d534319 100644
--- a/.github/workflows/citation.yml
+++ b/.github/workflows/citation.yml
@@ -4,8 +4,6 @@
 name: citation
 
 on:
-  pull_request:
-    paths: [CITATION.cff, .zenodo.json, tools/citation/**]
   push:
     branches: [main]
     paths: [CITATION.cff, .zenodo.json, tools/citation/**]
diff --git a/README.md b/README.md
index 0ae6232..712eb16 100644
--- a/README.md
+++ b/README.md
@@ -122,9 +122,10 @@ without a major bump (a minor bump before 1.0.0): the consumers break on their n
 
 ## CI
 
-GitHub-hosted runners only. [`ci.yml`](.github/workflows/ci.yml) checks that the legacy root
-evaluates; builds every lab (`nix flake check` with the lock required current, every `checks.*`
-output built) and lints it (`nixpkgs-fmt`, `statix`, `deadnix`, `shellcheck`, justfile parse,
+GitHub-hosted runners only. [`ci.yml`](.github/workflows/ci.yml) runs on a push to `main` and on
+`workflow_dispatch`, not on pull requests: run the gate locally before a PR. It checks that the
+legacy root evaluates; builds every lab (`nix flake check` with the lock required current, every
+`checks.*` output built; `ptbr-pdf`, which compiles Typst, only on `workflow_dispatch`) and lints it (`nixpkgs-fmt`, `statix`, `deadnix`, `shellcheck`, justfile parse,
 self-tests); runs the site rules (`just ci` in `site/`: format, tests, build and `site-check`);
 parses every justfile with Ubuntu 24.04's `just` 1.21; runs `reuse lint`, `actionlint` and the
 `citation` check. [`release.yml`](.github/workflows/release.yml) and
@@ -170,7 +171,9 @@ Each release from v0.1.1 is archived on [Zenodo](https://zenodo.org/), which giv
 the concept DOI, [10.5281/zenodo.23311208](https://doi.org/10.5281/zenodo.23311208), which always resolves to the latest
 version. GitHub's **Cite this repository** button exports APA and BibTeX from
 [`CITATION.cff`](CITATION.cff). `just citation` makes that file and the block below from
-[`.zenodo.json`](.zenodo.json).
+[`.zenodo.json`](.zenodo.json). Each version also has its own DOI: v0.2.0 is
+[10.5281/zenodo.23524112](https://doi.org/10.5281/zenodo.23524112), v0.1.1 is
+[10.5281/zenodo.23311209](https://doi.org/10.5281/zenodo.23311209).
 
 <!-- citation:start -->
 
@@ -247,9 +250,9 @@ picasso uses the same licences as the [ouroboric-dev](https://github.com/ourobor
 [`REUSE.toml`](REUSE.toml) says which licence and which copyright holder apply to each file, so no
 file carries a header; [`LICENSES/`](LICENSES) has every licence text, and CI runs `reuse lint`.
 
-Releases up to and including v0.1.1 ([10.5281/zenodo.23311208](https://doi.org/10.5281/zenodo.23311208))
+Releases up to and including v0.1.1 ([10.5281/zenodo.23311209](https://doi.org/10.5281/zenodo.23311209))
 were published under MIT, and those copies stay under MIT. The AGPL-3.0 and CC BY 4.0 terms apply
-from the next release. What is not mine, and under which terms:
+from v0.2.0 ([10.5281/zenodo.23524112](https://doi.org/10.5281/zenodo.23524112)). What is not mine, and under which terms:
 
 | What | Whose | Terms |
 |---|---|---|
diff --git a/tools/Cargo.lock b/tools/Cargo.lock
index 0885d9f..851108a 100644
--- a/tools/Cargo.lock
+++ b/tools/Cargo.lock
@@ -17,26 +17,17 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "base64"
-version = "0.22.1"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
-name = "base64"
-version = "0.23.1"
+name = "bitflags"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "bumpalo"
@@ -66,6 +57,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "citation"
 version = "0.1.0"
@@ -83,34 +80,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
-
-[[package]]
-name = "derive_arbitrary"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "displaydoc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.3"
@@ -140,15 +109,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "form_urlencoded"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
-dependencies = [
- "percent-encoding",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -182,110 +142,6 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
-[[package]]
-name = "icu_collections"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
-dependencies = [
- "displaydoc",
- "potential_utf",
- "utf8_iter",
- "yoke",
- "zerofrom",
- "zerovec",
-]
-
-[[package]]
-name = "icu_locale_core"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
-dependencies = [
- "displaydoc",
- "litemap",
- "tinystr",
- "writeable",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
-dependencies = [
- "icu_collections",
- "icu_normalizer_data",
- "icu_properties",
- "icu_provider",
- "smallvec",
- "zerovec",
-]
-
-[[package]]
-name = "icu_normalizer_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
-
-[[package]]
-name = "icu_properties"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
-dependencies = [
- "displaydoc",
- "icu_collections",
- "icu_locale_core",
- "icu_properties_data",
- "icu_provider",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "icu_properties_data"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
-
-[[package]]
-name = "icu_provider"
-version = "2.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
-dependencies = [
- "displaydoc",
- "icu_locale_core",
- "writeable",
- "yoke",
- "zerofrom",
- "zerotrie",
- "zerovec",
-]
-
-[[package]]
-name = "idna"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
-dependencies = [
- "idna_adapter",
- "smallvec",
- "utf8_iter",
-]
-
-[[package]]
-name = "idna_adapter"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
-dependencies = [
- "icu_normalizer",
- "icu_properties",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.14.2"
@@ -308,12 +164,6 @@ version = "0.2.191"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
 
-[[package]]
-name = "litemap"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
-
 [[package]]
 name = "log"
 version = "0.4.34"
@@ -336,6 +186,18 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -348,15 +210,6 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
-[[package]]
-name = "potential_utf"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
-dependencies = [
- "zerovec",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -408,7 +261,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 name = "render"
 version = "0.1.0"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "serde_json",
 ]
 
@@ -508,11 +361,11 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "0.6.9"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -553,12 +406,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "smallvec"
-version = "1.16.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
-
 [[package]]
 name = "social"
 version = "0.1.0"
@@ -566,16 +413,10 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "ureq 3.4.2",
+ "ureq",
  "zip",
 ]
 
-[[package]]
-name = "stable_deref_trait"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
-
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -594,59 +435,49 @@ dependencies = [
 ]
 
 [[package]]
-name = "synstructure"
-version = "0.14.0"
+name = "toml"
+version = "1.1.8+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
 ]
 
 [[package]]
-name = "tinystr"
-version = "0.8.4"
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
 dependencies = [
- "displaydoc",
- "zerovec",
+ "serde_core",
 ]
 
 [[package]]
-name = "toml"
-version = "0.8.23"
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
 dependencies = [
- "serde",
- "serde_spanned",
- "toml_datetime",
- "toml_edit",
+ "winnow",
 ]
 
 [[package]]
-name = "toml_datetime"
-version = "0.6.11"
+name = "toml_writer"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
 
 [[package]]
-name = "toml_edit"
-version = "0.22.27"
+name = "typed-path"
+version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
-dependencies = [
- "indexmap",
- "serde",
- "serde_spanned",
- "toml_datetime",
- "winnow",
-]
+checksum = "54ec2755506471f54baf5e4bb5499d8e510cc1caf271270e778a736bd2d7336c"
 
 [[package]]
 name = "unicode-ident"
@@ -660,36 +491,21 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
-[[package]]
-name = "ureq"
-version = "2.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
-dependencies = [
- "base64 0.22.1",
- "flate2",
- "log",
- "once_cell",
- "rustls",
- "rustls-pki-types",
- "url",
- "webpki-roots 0.26.11",
-]
-
 [[package]]
 name = "ureq"
 version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
 dependencies = [
- "base64 0.23.1",
+ "base64",
+ "flate2",
  "log",
  "percent-encoding",
  "rustls",
  "rustls-pki-types",
  "ureq-proto",
  "utf8-zero",
- "webpki-roots 1.0.10",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -698,51 +514,24 @@ version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841583fc36089d7d59419568ae157f43a5a03a2e5a81ba87c77d1596ef46e922"
 dependencies = [
- "base64 0.23.1",
+ "base64",
  "http",
  "httparse",
  "log",
 ]
 
-[[package]]
-name = "url"
-version = "2.5.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
-dependencies = [
- "form_urlencoded",
- "idna",
- "percent-encoding",
- "serde",
-]
-
 [[package]]
 name = "utf8-zero"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
 
-[[package]]
-name = "utf8_iter"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.10",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "1.0.10"
@@ -827,69 +616,16 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.7.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "writeable"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
-
-[[package]]
-name = "yoke"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
-dependencies = [
- "stable_deref_trait",
- "yoke-derive",
- "zerofrom",
-]
-
-[[package]]
-name = "yoke-derive"
-version = "0.8.4"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
-]
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 
 [[package]]
 name = "zenodo"
 version = "0.1.0"
 dependencies = [
  "serde_json",
- "ureq 2.12.1",
-]
-
-[[package]]
-name = "zerofrom"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
-dependencies = [
- "zerofrom-derive",
-]
-
-[[package]]
-name = "zerofrom-derive"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "synstructure",
+ "ureq",
 ]
 
 [[package]]
@@ -898,51 +634,18 @@ version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 
-[[package]]
-name = "zerotrie"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
-dependencies = [
- "displaydoc",
- "yoke",
- "zerofrom",
-]
-
-[[package]]
-name = "zerovec"
-version = "0.11.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
-dependencies = [
- "yoke",
- "zerofrom",
- "zerovec-derive",
-]
-
-[[package]]
-name = "zerovec-derive"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
 [[package]]
 name = "zip"
-version = "2.6.1"
+version = "9.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dcb24d0152526ae49b9b96c1dcf71850ca1e0b882e4e28ed898a93c41334744"
+checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e"
 dependencies = [
- "arbitrary",
  "crc32fast",
- "crossbeam-utils",
  "flate2",
  "indexmap",
  "memchr",
+ "nix",
+ "typed-path",
  "zopfli",
 ]
 
diff --git a/tools/render/Cargo.toml b/tools/render/Cargo.toml
index 91f80c6..ca57a95 100644
--- a/tools/render/Cargo.toml
+++ b/tools/render/Cargo.toml
@@ -5,5 +5,5 @@ edition = "2024"
 description = "Prints an HTML page to a PDF with headless Chromium (DevTools over a pipe), with a footer."
 
 [dependencies]
-base64 = "0.22"
+base64 = "0.23"
 serde_json = "1"
diff --git a/tools/sharingan/Cargo.toml b/tools/sharingan/Cargo.toml
index 7481586..088819a 100644
--- a/tools/sharingan/Cargo.toml
+++ b/tools/sharingan/Cargo.toml
@@ -9,4 +9,4 @@ description = "ouroboric-sharingan's licence scanner and benchmark runner"
 regex = "1"
 serde = "1"
 serde_json = { version = "1", features = ["preserve_order"] }
-toml = { version = "0.8", default-features = false, features = ["parse"] }
+toml = { version = "1", default-features = false, features = ["parse", "serde", "std"] }
diff --git a/tools/social/Cargo.toml b/tools/social/Cargo.toml
index 5573cb6..1307089 100644
--- a/tools/social/Cargo.toml
+++ b/tools/social/Cargo.toml
@@ -11,4 +11,4 @@ regex = "1"
 serde = "1"
 serde_json = { version = "1", features = ["preserve_order"] }
 ureq = { version = "3", default-features = false, features = ["rustls"] }
-zip = { version = "2", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
diff --git a/tools/zenodo/Cargo.toml b/tools/zenodo/Cargo.toml
index 3017974..c49a46f 100644
--- a/tools/zenodo/Cargo.toml
+++ b/tools/zenodo/Cargo.toml
@@ -7,4 +7,4 @@ license = "AGPL-3.0-only"
 
 [dependencies]
 serde_json = "1"
-ureq = "2"
+ureq = "3"
diff --git a/tools/zenodo/src/main.rs b/tools/zenodo/src/main.rs
index 0fbe6ec..31aab94 100644
--- a/tools/zenodo/src/main.rs
+++ b/tools/zenodo/src/main.rs
@@ -28,21 +28,30 @@ fn api(
     body: Option<Value>,
     raw: Option<Vec<u8>>,
 ) -> Result<Value, String> {
-    let req = ureq::request(method, &format!("{base}{path}"))
-        .set("Authorization", &format!("Bearer {token}"));
+    let req = ureq::http::Request::builder()
+        .method(method)
+        .uri(format!("{base}{path}"))
+        .header("Authorization", format!("Bearer {token}"));
     let res = match (raw, body) {
         (Some(bytes), _) => req
-            .set("Content-Type", "application/octet-stream")
-            .send_bytes(&bytes),
+            .header("Content-Type", "application/octet-stream")
+            .body(bytes)
+            .map(ureq::run),
         (None, Some(b)) => req
-            .set("Content-Type", "application/json")
-            .send_string(&b.to_string()),
-        (None, None) => req.set("Content-Type", "application/json").call(),
+            .header("Content-Type", "application/json")
+            .body(b.to_string())
+            .map(ureq::run),
+        (None, None) => req
+            .header("Content-Type", "application/json")
+            .body(())
+            .map(ureq::run),
     };
     // the error text never includes the request headers, so the token stays out of the logs
     let text = res
         .map_err(|e| e.to_string())?
-        .into_string()
+        .map_err(|e| e.to_string())?
+        .into_body()
+        .read_to_string()
         .map_err(|e| e.to_string())?;
     if text.trim().is_empty() {
         Ok(json!({}))