diff --git a/.github/workflows/initiate-release.yml b/.github/workflows/initiate-release.yml
index 4c39114..0cadc1b 100644
--- a/.github/workflows/initiate-release.yml
+++ b/.github/workflows/initiate-release.yml
@@ -11,6 +11,15 @@ on:
           - patch
           - minor
           - major
+      release_target:
+        description: "SDK target to release"
+        required: true
+        type: choice
+        options:
+          - js-core
+          - react
+          - kotlin
+          - swift
 
 jobs:
   initiate-release:
@@ -28,30 +37,56 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          toolchain: stable
-
-      - name: Setup Node.js (for jq alternative)
+      - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 18
 
-      - name: Calculate new version
+      - name: Resolve current version and calculate next version
         id: version
         env:
           BUMP_TYPE: ${{ github.event.inputs.bump_type }}
+          RELEASE_TARGET: ${{ github.event.inputs.release_target }}
         run: |
-          # Get current version from workspace package in Cargo.toml
-          CURRENT_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name=="idkit-core") | .version')
+          case "$RELEASE_TARGET" in
+            "js-core")
+              CURRENT_VERSION=$(node -p "require('./js/packages/core/package.json').version")
+              TARGET_FILE="js/packages/core/package.json"
+              TARGET_NAME="JS Core"
+              ;;
+            "react")
+              CURRENT_VERSION=$(node -p "require('./js/packages/react/package.json').version")
+              TARGET_FILE="js/packages/react/package.json"
+              TARGET_NAME="React"
+              ;;
+            "kotlin")
+              CURRENT_VERSION=$(grep '^version=' kotlin/gradle.properties | cut -d= -f2- | tr -d '[:space:]')
+              TARGET_FILE="kotlin/gradle.properties"
+              TARGET_NAME="Kotlin"
+              ;;
+            "swift")
+              CURRENT_VERSION=$(sed -n 's/.*public static let version = "\([^"]*\)".*/\1/p' swift/Sources/IDKit/IDKit.swift | head -n1)
+              TARGET_FILE="swift/Sources/IDKit/IDKit.swift"
+              TARGET_NAME="Swift"
+              ;;
+            *)
+              echo "Unsupported release target: $RELEASE_TARGET"
+              exit 1
+              ;;
+          esac
+
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "Failed to resolve current version for target: $RELEASE_TARGET"
+            exit 1
+          fi
 
           # Ensure CURRENT_VERSION is in semantic versioning format
           if [[ ! "$CURRENT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              echo "CRITICAL ERROR: CURRENT_VERSION '$CURRENT_VERSION' is not in semantic versioning format (MAJOR.MINOR.PATCH)."
-              exit 1
+            echo "CRITICAL ERROR: CURRENT_VERSION '$CURRENT_VERSION' is not in semantic versioning format (MAJOR.MINOR.PATCH)."
+            exit 1
           fi
 
-          echo "Current version: $CURRENT_VERSION"
+          echo "Current version for $TARGET_NAME: $CURRENT_VERSION"
 
           # Split version into components
           IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT_VERSION"
@@ -69,64 +104,55 @@ jobs:
               ;;
           esac
 
-          echo "New version will be: $NEW_VERSION"
+          echo "New version for $TARGET_NAME: $NEW_VERSION"
           echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "target_file=$TARGET_FILE" >> $GITHUB_OUTPUT
+          echo "target_name=$TARGET_NAME" >> $GITHUB_OUTPUT
+          echo "release_target=$RELEASE_TARGET" >> $GITHUB_OUTPUT
 
-      - name: Install cargo-edit
-        run: cargo install cargo-edit
-
-      - name: Update Cargo.toml version
-        run: cargo set-version ${{ steps.version.outputs.new_version }}
-
-      - name: Sync Swift version
+      - name: Update target SDK version
         env:
+          RELEASE_TARGET: ${{ steps.version.outputs.release_target }}
           NEW_VERSION: ${{ steps.version.outputs.new_version }}
         run: |
-          # Update version in IDKit.swift
-          sed -i "s/version = \".*\"/version = \"$NEW_VERSION\"/" swift/Sources/IDKit/IDKit.swift
-
-          # Verify the change was made
-          if ! grep -q "version = \"$NEW_VERSION\"" swift/Sources/IDKit/IDKit.swift; then
-            echo "❌ Failed to update Swift version"
-            exit 1
-          fi
-          echo "✅ Updated swift/Sources/IDKit/IDKit.swift"
-
-      - name: Sync JS versions
-        env:
-          NEW_VERSION: ${{ steps.version.outputs.new_version }}
-        run: |
-          # Update js/package.json
-          cd js
-          node -e "
-            const fs = require('fs');
-            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-            pkg.version = '$NEW_VERSION';
-            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
-          "
-
-          # Verify the change was made
-          if ! grep -q "\"version\": \"$NEW_VERSION\"" package.json; then
-            echo "❌ Failed to update js/package.json version"
-            exit 1
-          fi
-          echo "✅ Updated js/package.json"
-
-          # Update js/packages/core/package.json
-          cd packages/core
-          node -e "
-            const fs = require('fs');
-            const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
-            pkg.version = '$NEW_VERSION';
-            fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
-          "
-
-          # Verify the change was made
-          if ! grep -q "\"version\": \"$NEW_VERSION\"" package.json; then
-            echo "❌ Failed to update js/packages/core/package.json version"
-            exit 1
-          fi
-          echo "✅ Updated js/packages/core/package.json"
+          case "$RELEASE_TARGET" in
+            "js-core")
+              node -e "
+                const fs = require('fs');
+                const pkgPath = 'js/packages/core/package.json';
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+                pkg.version = '$NEW_VERSION';
+                fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+              "
+              grep -q "\"version\": \"$NEW_VERSION\"" js/packages/core/package.json || { echo "❌ Failed to update js/packages/core/package.json"; exit 1; }
+              echo "✅ Updated js/packages/core/package.json"
+              ;;
+            "react")
+              node -e "
+                const fs = require('fs');
+                const pkgPath = 'js/packages/react/package.json';
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+                pkg.version = '$NEW_VERSION';
+                fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+              "
+              grep -q "\"version\": \"$NEW_VERSION\"" js/packages/react/package.json || { echo "❌ Failed to update js/packages/react/package.json"; exit 1; }
+              echo "✅ Updated js/packages/react/package.json"
+              ;;
+            "kotlin")
+              sed -i "s/^version=.*/version=$NEW_VERSION/" kotlin/gradle.properties
+              grep -q "^version=$NEW_VERSION$" kotlin/gradle.properties || { echo "❌ Failed to update kotlin/gradle.properties"; exit 1; }
+              echo "✅ Updated kotlin/gradle.properties"
+              ;;
+            "swift")
+              sed -i "s/public static let version = \".*\"/public static let version = \"$NEW_VERSION\"/" swift/Sources/IDKit/IDKit.swift
+              grep -q "public static let version = \"$NEW_VERSION\"" swift/Sources/IDKit/IDKit.swift || { echo "❌ Failed to update swift/Sources/IDKit/IDKit.swift"; exit 1; }
+              echo "✅ Updated swift/Sources/IDKit/IDKit.swift"
+              ;;
+            *)
+              echo "Unsupported release target: $RELEASE_TARGET"
+              exit 1
+              ;;
+          esac
 
       - name: Generate Release Notes
         id: release_notes
@@ -163,7 +189,7 @@ jobs:
       - name: Get branch name
         id: branch_name
         env:
-          CANDIDATE_BRANCH_NAME: release-${{ steps.version.outputs.new_version }}
+          CANDIDATE_BRANCH_NAME: release-${{ steps.version.outputs.release_target }}-${{ steps.version.outputs.new_version }}
         run: |
           BRANCH_NAME="$CANDIDATE_BRANCH_NAME"
 
@@ -183,28 +209,32 @@ jobs:
           RELEASE_NOTES: ${{ steps.release_notes.outputs.release_notes }}
           BRANCH_NAME: ${{ steps.branch_name.outputs.branch_name }}
           NEW_VERSION: ${{ steps.version.outputs.new_version }}
+          RELEASE_TARGET: ${{ steps.version.outputs.release_target }}
+          TARGET_FILE: ${{ steps.version.outputs.target_file }}
+          TARGET_NAME: ${{ steps.version.outputs.target_name }}
         run: |
           git checkout -b "$BRANCH_NAME"
 
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
 
-          # Add all version-related files
-          git add Cargo.toml
-          git add Cargo.lock
-          git add swift/Sources/IDKit/IDKit.swift
-          git add js/package.json
-          git add js/packages/core/package.json
+          # Add only the target SDK version file
+          git add "$TARGET_FILE"
 
-          git commit -m "Release $NEW_VERSION"
+          git commit -m "Release ${TARGET_NAME} ${NEW_VERSION}"
           git push origin "$BRANCH_NAME"
 
           echo "Creating PR with release notes:"
           echo "$RELEASE_NOTES"
 
+          {
+            printf '<!-- release_target:%s -->\n\n' "$RELEASE_TARGET"
+            printf '%s\n' "$RELEASE_NOTES"
+          } > /tmp/release-pr-body.md
+
           gh pr create \
-            --title "IDKit Release $NEW_VERSION" \
-            --body "$RELEASE_NOTES" \
+            --title "IDKit ${TARGET_NAME} Release $NEW_VERSION" \
+            --body-file /tmp/release-pr-body.md \
             --base main \
             --label "release" \
             --head "$BRANCH_NAME"
diff --git a/.github/workflows/publish-js.yml b/.github/workflows/publish-js.yml
index 2152a01..316196d 100644
--- a/.github/workflows/publish-js.yml
+++ b/.github/workflows/publish-js.yml
@@ -34,13 +34,17 @@ jobs:
           EVENT_NAME: ${{ github.event_name }}
           INPUT_COMMIT_SHA: ${{ inputs.commit_sha }}
           GITHUB_SHA: ${{ github.sha }}
-          IS_RELEASE_PR: ${{ github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'release') }}
+          PR_MERGED: ${{ github.event.pull_request.merged }}
+          PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+          PR_BODY: ${{ github.event.pull_request.body }}
         run: |
           if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             echo "npm_tag=dev" >> $GITHUB_OUTPUT
             echo "should_publish=true" >> $GITHUB_OUTPUT
             echo "ref=${INPUT_COMMIT_SHA:-$GITHUB_SHA}" >> $GITHUB_OUTPUT
-          elif [ "$IS_RELEASE_PR" = "true" ]; then
+          elif [ "$PR_MERGED" = "true" ] && \
+               echo "$PR_LABELS" | grep -q '"release"' && \
+               echo "$PR_BODY" | grep -q "<!-- release_target:js-core -->"; then
             echo "npm_tag=latest" >> $GITHUB_OUTPUT
             echo "should_publish=true" >> $GITHUB_OUTPUT
             echo "ref=$GITHUB_SHA" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/publish-kotlin.yml b/.github/workflows/publish-kotlin.yml
index 6307f8d..f04237f 100644
--- a/.github/workflows/publish-kotlin.yml
+++ b/.github/workflows/publish-kotlin.yml
@@ -39,6 +39,7 @@ jobs:
           GH_SHA: ${{ github.sha }}
           PR_MERGED: ${{ github.event.pull_request.merged }}
           PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+          PR_BODY: ${{ github.event.pull_request.body }}
         run: |
           if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             echo "Release type: dev"
@@ -51,7 +52,8 @@ jobs:
             fi
           elif [ "$EVENT_NAME" = "pull_request" ]; then
             if [ "$PR_MERGED" = "true" ] && \
-               echo "$PR_LABELS" | grep -q '"release"'; then
+               echo "$PR_LABELS" | grep -q '"release"' && \
+               echo "$PR_BODY" | grep -q "<!-- release_target:kotlin -->"; then
               echo "Release type: production"
               echo "environment=production" >> $GITHUB_OUTPUT
               echo "should_publish=true" >> $GITHUB_OUTPUT
@@ -79,7 +81,11 @@ jobs:
         if: steps.release-type.outputs.should_publish == 'true'
         id: version
         run: |
-          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name=="idkit-core") | .version')
+          BASE_VERSION=$(grep '^version=' kotlin/gradle.properties | cut -d= -f2- | tr -d '[:space:]')
+          if [ -z "$BASE_VERSION" ]; then
+            echo "Error: Failed to resolve version from kotlin/gradle.properties"
+            exit 1
+          fi
 
           if [ "${{ steps.release-type.outputs.environment }}" = "development" ]; then
             SHORT_SHA=$(echo "${{ steps.release-type.outputs.ref }}" | cut -c1-7)
@@ -92,29 +98,6 @@ jobs:
 
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Validate version (production only)
-        if: steps.release-type.outputs.should_publish == 'true' && steps.release-type.outputs.environment == 'production'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-
-          LATEST_RELEASE=$(gh release list -L 1 --exclude-pre-releases --repo worldcoin/idkit --json tagName -q '.[0].tagName' 2>/dev/null || echo "0.0.0")
-          LATEST_RELEASE="${LATEST_RELEASE#v}"
-
-          echo "Latest release on GitHub: $LATEST_RELEASE"
-          echo "New version: $VERSION"
-
-          if [ "$LATEST_RELEASE" != "0.0.0" ]; then
-            if ! { [ "$(printf '%s\n' "$LATEST_RELEASE" "$VERSION" | sort -V | tail -n1)" = "$VERSION" ] && \
-                   [ "$VERSION" != "$LATEST_RELEASE" ]; }; then
-              echo "Error: New version ($VERSION) is not greater than latest release ($LATEST_RELEASE)"
-              exit 1
-            fi
-          fi
-
-          echo "Version check passed: $VERSION > $LATEST_RELEASE"
-
   build-host:
     name: Build Host Library & UniFFI Bindings
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-react.yml b/.github/workflows/publish-react.yml
new file mode 100644
index 0000000..05b370f
--- /dev/null
+++ b/.github/workflows/publish-react.yml
@@ -0,0 +1,222 @@
+name: Publish React Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit_sha:
+        description: "Commit SHA to publish as dev release (leave empty for HEAD)"
+        required: false
+        type: string
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  prepare:
+    runs-on:
+      group: arc-public-large-amd64-runner
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      core_version: ${{ steps.version.outputs.core_version }}
+      npm_tag: ${{ steps.config.outputs.npm_tag }}
+      ref: ${{ steps.config.outputs.ref }}
+      should_publish: ${{ steps.config.outputs.should_publish }}
+
+    steps:
+      - name: Determine release type
+        id: config
+        # Use env vars to avoid script injection via github context interpolation
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_COMMIT_SHA: ${{ inputs.commit_sha }}
+          GITHUB_SHA: ${{ github.sha }}
+          PR_MERGED: ${{ github.event.pull_request.merged }}
+          PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "npm_tag=dev" >> $GITHUB_OUTPUT
+            echo "should_publish=true" >> $GITHUB_OUTPUT
+            echo "ref=${INPUT_COMMIT_SHA:-$GITHUB_SHA}" >> $GITHUB_OUTPUT
+          elif [ "$PR_MERGED" = "true" ] && \
+               echo "$PR_LABELS" | grep -q '"release"' && \
+               echo "$PR_BODY" | grep -q "<!-- release_target:react -->"; then
+            echo "npm_tag=latest" >> $GITHUB_OUTPUT
+            echo "should_publish=true" >> $GITHUB_OUTPUT
+            echo "ref=$GITHUB_SHA" >> $GITHUB_OUTPUT
+          else
+            echo "should_publish=false" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/checkout@v6
+        if: steps.config.outputs.should_publish == 'true'
+        with:
+          ref: ${{ steps.config.outputs.ref }}
+
+      - name: Generate versions
+        if: steps.config.outputs.should_publish == 'true'
+        id: version
+        run: |
+          BASE_VERSION=$(node -p "require('./js/packages/react/package.json').version")
+          CORE_VERSION=$(node -p "require('./js/packages/core/package.json').version")
+
+          if [ -z "$BASE_VERSION" ] || [ -z "$CORE_VERSION" ]; then
+            echo "Error: Failed to resolve react/core versions from package manifests"
+            exit 1
+          fi
+
+          if [ "${{ steps.config.outputs.npm_tag }}" = "dev" ]; then
+            BASE_VERSION=$(echo "$BASE_VERSION" | sed 's/-.*$//')
+            SHORT_SHA=$(git rev-parse --short HEAD)
+            VERSION="${BASE_VERSION}-dev.${SHORT_SHA}"
+            echo "Dev version: $VERSION"
+          else
+            VERSION="$BASE_VERSION"
+            echo "Production version: $VERSION"
+          fi
+
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "core_version=$CORE_VERSION" >> $GITHUB_OUTPUT
+
+      - name: Validate version against npm
+        if: steps.config.outputs.should_publish == 'true' && steps.config.outputs.npm_tag == 'latest'
+        run: |
+          NEW_VERSION="${{ steps.version.outputs.version }}"
+          LATEST_RELEASE=$(npm view @worldcoin/idkit version 2>/dev/null || echo "0.0.0")
+
+          echo "Latest release on npm: $LATEST_RELEASE"
+          echo "New version: $NEW_VERSION"
+
+          if [ "$LATEST_RELEASE" != "0.0.0" ]; then
+            if ! { [ "$(printf '%s\n' "$LATEST_RELEASE" "$NEW_VERSION" | sort -V | tail -n1)" = "$NEW_VERSION" ] && \
+                   [ "$NEW_VERSION" != "$LATEST_RELEASE" ]; }; then
+              echo "Error: New version ($NEW_VERSION) is not greater than latest release ($LATEST_RELEASE)"
+              exit 1
+            fi
+          fi
+
+          echo "Version check passed: $NEW_VERSION > $LATEST_RELEASE"
+
+      - name: Validate core dependency exists on npm (production only)
+        if: steps.config.outputs.should_publish == 'true' && steps.config.outputs.npm_tag == 'latest'
+        env:
+          CORE_VERSION: ${{ steps.version.outputs.core_version }}
+        run: |
+          if ! npm view "@worldcoin/idkit-core@$CORE_VERSION" version >/dev/null 2>&1; then
+            echo "Error: Required core dependency @worldcoin/idkit-core@$CORE_VERSION is not published on npm"
+            exit 1
+          fi
+
+          echo "Core dependency check passed: @worldcoin/idkit-core@$CORE_VERSION"
+
+  publish:
+    needs: prepare
+    if: needs.prepare.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prepare.outputs.ref }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Update npm for OIDC trusted publishing
+        run: |
+          # npm trusted publishing requires npm >= 11.5.1
+          echo "Current npm version: $(npm --version)"
+          npm install -g npm@latest
+          echo "Updated npm version: $(npm --version)"
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install wasm-pack
+        run: cargo install wasm-pack --locked
+
+      - name: Set package version
+        working-directory: js/packages/react
+        env:
+          PKG_VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          npm version "$PKG_VERSION" --no-git-tag-version --allow-same-version
+          echo "Package version set to: $PKG_VERSION"
+
+      - name: Install dependencies
+        working-directory: js
+        run: pnpm install
+
+      - name: Build packages
+        working-directory: js
+        run: pnpm -r build
+
+      - name: Rewrite core dependency to published version
+        working-directory: js/packages/react
+        env:
+          CORE_VERSION: ${{ needs.prepare.outputs.core_version }}
+        run: |
+          node -e "
+            const fs = require('fs');
+            const pkgPath = 'package.json';
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+            pkg.dependencies = pkg.dependencies || {};
+            pkg.dependencies['@worldcoin/idkit-core'] = process.env.CORE_VERSION;
+            fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+          "
+
+          echo "Updated @worldcoin/idkit-core dependency to ${CORE_VERSION}"
+
+      - name: Verify packaged manifest does not contain workspace protocol
+        working-directory: js/packages/react
+        env:
+          CORE_VERSION: ${{ needs.prepare.outputs.core_version }}
+          NPM_TAG: ${{ needs.prepare.outputs.npm_tag }}
+        run: |
+          PACK_OUTPUT=$(npm pack --pack-destination /tmp --json)
+          TARBALL=$(echo "$PACK_OUTPUT" | jq -r '.[0].filename')
+          PACKAGE_JSON=$(tar -xOf "/tmp/$TARBALL" package/package.json)
+
+          if echo "$PACKAGE_JSON" | jq -e '.dependencies["@worldcoin/idkit-core"] == "workspace:*"' >/dev/null; then
+            echo "Error: packaged dependency still uses workspace:*"
+            exit 1
+          fi
+
+          if ! echo "$PACKAGE_JSON" | jq -e --arg core "$CORE_VERSION" '.dependencies["@worldcoin/idkit-core"] == $core' >/dev/null; then
+            echo "Error: packaged dependency does not match expected core version $CORE_VERSION"
+            exit 1
+          fi
+
+          if [ "$NPM_TAG" = "latest" ]; then
+            TMP_DIR=$(mktemp -d)
+            cd "$TMP_DIR"
+            npm init -y >/dev/null 2>&1
+            npm install "/tmp/$TARBALL" --ignore-scripts --no-audit --no-fund
+            echo "Tarball install check passed for production release"
+          fi
+
+      - name: Publish @worldcoin/idkit
+        working-directory: js/packages/react
+        env:
+          PKG_VERSION: ${{ needs.prepare.outputs.version }}
+          NPM_TAG: ${{ needs.prepare.outputs.npm_tag }}
+        run: |
+          echo "Publishing @worldcoin/idkit@$PKG_VERSION with tag '$NPM_TAG'"
+          npm publish --access public --provenance --tag "$NPM_TAG"
diff --git a/.github/workflows/publish-swift.yml b/.github/workflows/publish-swift.yml
index 9256d72..fcefab7 100644
--- a/.github/workflows/publish-swift.yml
+++ b/.github/workflows/publish-swift.yml
@@ -17,9 +17,6 @@ permissions:
 
 jobs:
   prepare:
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release'))
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -38,6 +35,9 @@ jobs:
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           INPUT_COMMIT_SHA: ${{ inputs.commit_sha }}
           GITHUB_SHA_VAL: ${{ github.sha }}
+          PR_MERGED: ${{ github.event.pull_request.merged }}
+          PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+          PR_BODY: ${{ github.event.pull_request.body }}
         run: |
           if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
             # Dev release triggered manually
@@ -50,13 +50,21 @@ jobs:
             echo "should_publish=true" >> $GITHUB_OUTPUT
             echo "release_type=dev" >> $GITHUB_OUTPUT
             echo "📦 Dev release from commit: $REF"
-          else
+          elif [ "$PR_MERGED" = "true" ] && \
+               echo "$PR_LABELS" | grep -q '"release"' && \
+               echo "$PR_BODY" | grep -q "<!-- release_target:swift -->"; then
             # Production release from PR merge
             echo "ref=$GITHUB_SHA_VAL" >> $GITHUB_OUTPUT
             echo "is_prerelease=false" >> $GITHUB_OUTPUT
             echo "should_publish=true" >> $GITHUB_OUTPUT
             echo "release_type=production" >> $GITHUB_OUTPUT
             echo "📦 Production release from PR merge"
+          else
+            echo "ref=" >> $GITHUB_OUTPUT
+            echo "is_prerelease=" >> $GITHUB_OUTPUT
+            echo "should_publish=false" >> $GITHUB_OUTPUT
+            echo "release_type=" >> $GITHUB_OUTPUT
+            echo "Skipping: not a matching swift release event"
           fi
 
       - name: Checkout code
@@ -69,9 +77,9 @@ jobs:
         if: steps.config.outputs.should_publish == 'true'
         id: version
         run: |
-          BASE_VERSION=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name=="idkit-core") | .version')
+          BASE_VERSION=$(sed -n 's/.*public static let version = "\([^"]*\)".*/\1/p' swift/Sources/IDKit/IDKit.swift | head -n1)
           if [ -z "$BASE_VERSION" ]; then
-            echo "Error: Failed to resolve version from package idkit-core"
+            echo "Error: Failed to resolve version from swift/Sources/IDKit/IDKit.swift"
             exit 1
           fi
 
diff --git a/Cargo.toml b/Cargo.toml
index e5c3656..ae5ed53 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,7 @@ members = [
 ]
 
 [workspace.package]
+# Rust workspace version is managed independently from SDK initiate-release workflow bumps.
 version = "4.0.0"
 edition = "2021"
 license = "MIT"
diff --git a/js/examples/nextjs/next.config.ts b/js/examples/nextjs/next.config.ts
index cb651cd..e259252 100644
--- a/js/examples/nextjs/next.config.ts
+++ b/js/examples/nextjs/next.config.ts
@@ -1,5 +1,17 @@
 import type { NextConfig } from "next";
 
-const nextConfig: NextConfig = {};
+// **Note**: This is a workaround to make the vercel deployment work with idkit.
+// You do NOT need to do this in your own project, because the idkit package is pulled from npm and not linked from the monorepo.
+const nextConfig: NextConfig = {
+  // Prevent Next.js from bundling idkit-core on the server.
+  // This preserves the file structure so import.meta.url resolves
+  // the .wasm file correctly from node_modules.
+  serverExternalPackages: ["@worldcoin/idkit-core"],
+
+  // Include the WASM binary in serverless function bundles
+  outputFileTracingIncludes: {
+    "/api/rp-signature": ["../../packages/core/dist/*.wasm"],
+  },
+};
 
 export default nextConfig;
diff --git a/kotlin/bindings/build.gradle.kts b/kotlin/bindings/build.gradle.kts
index c4f7b6a..f460d38 100644
--- a/kotlin/bindings/build.gradle.kts
+++ b/kotlin/bindings/build.gradle.kts
@@ -8,15 +8,10 @@ plugins {
 
 group = "com.worldcoin"
 
-// Read version from Cargo.toml (single source of truth)
-val cargoToml = file("../../Cargo.toml")
-val versionRegex = """version\s*=\s*"([^"]+)"""".toRegex()
-val cargoContent = cargoToml.readText()
-
 // Support version override from CI for dev releases
 version = System.getenv("PKG_VERSION")?.takeIf { it.isNotBlank() }
-    ?: versionRegex.find(cargoContent)?.groupValues?.get(1)
-    ?: throw GradleException("Could not find version in Cargo.toml")
+    ?: project.version.toString().takeIf { it.isNotBlank() && it != "unspecified" }
+    ?: throw GradleException("Could not find version in kotlin/gradle.properties")
 
 java {
     toolchain {
diff --git a/kotlin/gradle.properties b/kotlin/gradle.properties
new file mode 100644
index 0000000..19a0188
--- /dev/null
+++ b/kotlin/gradle.properties
@@ -0,0 +1 @@
+version=4.0.0
diff --git a/scripts/package-kotlin.sh b/scripts/package-kotlin.sh
index 869f50f..3efc476 100755
--- a/scripts/package-kotlin.sh
+++ b/scripts/package-kotlin.sh
@@ -11,8 +11,11 @@ echo "📦 Packaging Kotlin bindings"
 # Build bindings and native libs (host + Android if Docker available)
 SKIP_ANDROID=${SKIP_ANDROID:-0} "$SCRIPT_DIR/build-kotlin.sh"
 
-VERSION=$(cargo metadata --no-deps --format-version 1 \
-  | jq -r '.packages[] | select(.name=="idkit-core") | .version')
+VERSION=$(grep '^version=' "$KOTLIN_DIR/gradle.properties" | cut -d= -f2- | tr -d '[:space:]')
+if [ -z "$VERSION" ]; then
+  echo "❌ Failed to resolve version from kotlin/gradle.properties"
+  exit 1
+fi
 
 rm -rf "$DIST_DIR"
 mkdir -p "$DIST_DIR"