diff --git a/.github/workflows/ci-crates-preflight.yml b/.github/workflows/ci-crates-preflight.yml
new file mode 100644
index 0000000000..28948a1572
--- /dev/null
+++ b/.github/workflows/ci-crates-preflight.yml
@@ -0,0 +1,19 @@
+name: ci-crates-preflight
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'Cargo.toml'
+      - '**/Cargo.toml'
+      - 'tools/internal/check_publish_preflight.py'
+      - '.github/workflows/ci-crates-preflight.yml'
+
+jobs:
+  preflight:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      - name: Preflight publish checks
+        run: python3 tools/internal/check_publish_preflight.py
diff --git a/.github/workflows/ci-crates-publish-dry-run.yml b/.github/workflows/ci-crates-publish-dry-run.yml
index fa2714e7bb..8c3af47db6 100644
--- a/.github/workflows/ci-crates-publish-dry-run.yml
+++ b/.github/workflows/ci-crates-publish-dry-run.yml
@@ -57,7 +57,8 @@ jobs:
 
       - name: Update workspace dependencies
         run: |
-          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
+          # Match any semver version on lines with `path = `, not just the current workspace version.
+          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
 
       - name: Bump versions (local only)
         run: |
diff --git a/.github/workflows/ci-crates-publish.yml b/.github/workflows/ci-crates-publish.yml
index 94290c8a2d..57f744e7f2 100644
--- a/.github/workflows/ci-crates-publish.yml
+++ b/.github/workflows/ci-crates-publish.yml
@@ -33,7 +33,11 @@ jobs:
       - name: Install cargo-workspaces
         run: cargo install cargo-workspaces
 
-      # `--publish-as-is` skips version bumping since that's done in a separate CI job.
+      - name: Preflight publish checks
+        run: |
+          python3 tools/internal/check_publish_preflight.py
+
+      # --publish-as-is skips version bumping since that's done in a separate CI job.
       - name: Publish
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/.github/workflows/ci-crates-version-bump.yml b/.github/workflows/ci-crates-version-bump.yml
index eebc0d64ac..0539d6b9f4 100644
--- a/.github/workflows/ci-crates-version-bump.yml
+++ b/.github/workflows/ci-crates-version-bump.yml
@@ -19,6 +19,7 @@ jobs:
       RUSTUP_PERMIT_COPY_RENAME: 1
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@v6
@@ -58,7 +59,9 @@ jobs:
 
       - name: Update workspace dependencies
         run: |
-          sed -i '/path = /s/version = "${{ steps.current_version.outputs.version }}"/version = "${{ inputs.version }}"/g' Cargo.toml
+          # Match any semver version on lines with `path = `, not just the current workspace version.
+          # This catches entries whose version has drifted (e.g. nym-sqlx-pool-guard at 1.2.0).
+          sed -i '/path = /s/version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.version }}"/g' Cargo.toml
 
       - name: Bump versions
         run: |
@@ -68,9 +71,33 @@ jobs:
 
       - name: Commit and push version bump
         run: |
+          set -euo pipefail
+          BASE_BRANCH="${GITHUB_REF_NAME}"
+          PR_BRANCH="ci/crates-version-bump-${{ inputs.version }}-${GITHUB_RUN_ID}"
+
+          git checkout -b "$PR_BRANCH"
           git add -A
           git commit -m "crates release: bump version to ${{ inputs.version }}"
-          git push
+          git push -u origin "$PR_BRANCH"
+
+          cat > /tmp/crates-version-bump-pr-body.md <<'EOF'
+          This PR was created by CI because direct pushes to the release branch are blocked by branch protection rules.
+
+          ## Summary
+          - Bump workspace crate versions to the requested release version.
+          - Update workspace dependency versions accordingly.
+
+          ## Notes
+          - Merge this PR to proceed with crates.io publishing.
+          EOF
+
+          gh pr create \
+            --base "$BASE_BRANCH" \
+            --head "$PR_BRANCH" \
+            --title "crates release: bump version to ${{ inputs.version }}" \
+            --body-file /tmp/crates-version-bump-pr-body.md
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Show package versions
         run: cargo workspaces list --long
diff --git a/Cargo.lock b/Cargo.lock
index 2fc4083844..8c8df62b24 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2642,7 +2642,7 @@ checksum = "1c7a8fb8a9fbf66c1f703fe16184d10ca0ee9d23be5b4436400408ba54a95005"
 
 [[package]]
 name = "easy-addr"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-std",
  "quote",
@@ -5718,7 +5718,7 @@ dependencies = [
 
 [[package]]
 name = "nym-api-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bs58",
  "celes",
@@ -5760,7 +5760,7 @@ dependencies = [
 
 [[package]]
 name = "nym-async-file-watcher"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "futures",
  "log",
@@ -5770,7 +5770,7 @@ dependencies = [
 
 [[package]]
 name = "nym-authenticator-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "futures",
@@ -5792,7 +5792,7 @@ dependencies = [
 
 [[package]]
 name = "nym-authenticator-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "base64 0.22.1",
  "bincode",
@@ -5816,7 +5816,7 @@ dependencies = [
 
 [[package]]
 name = "nym-bandwidth-controller"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "log",
@@ -5833,7 +5833,7 @@ dependencies = [
 
 [[package]]
 name = "nym-bin-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "clap",
  "clap_complete",
@@ -5873,7 +5873,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cache"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "tokio",
 ]
@@ -5904,7 +5904,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cli-commands"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -6000,7 +6000,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client-core"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -6062,7 +6062,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client-core-config-types"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "humantime-serde",
  "nym-config",
@@ -6077,7 +6077,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client-core-gateways-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6096,7 +6096,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client-core-surb-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6142,7 +6142,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client-websocket-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-sphinx",
  "serde",
@@ -6151,7 +6151,7 @@ dependencies = [
 
 [[package]]
 name = "nym-coconut-dkg-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cosmwasm-std",
@@ -6164,7 +6164,7 @@ dependencies = [
 
 [[package]]
 name = "nym-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "tracing",
  "tracing-test",
@@ -6172,7 +6172,7 @@ dependencies = [
 
 [[package]]
 name = "nym-compact-ecash"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "bs58",
@@ -6196,7 +6196,7 @@ dependencies = [
 
 [[package]]
 name = "nym-config"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "dirs",
  "handlebars",
@@ -6228,7 +6228,7 @@ dependencies = [
 
 [[package]]
 name = "nym-contracts-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "bs58",
@@ -6245,7 +6245,7 @@ dependencies = [
 
 [[package]]
 name = "nym-contracts-common-testing"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "cosmwasm-std",
@@ -6259,7 +6259,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cpp-ffi"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "bs58",
@@ -6322,7 +6322,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credential-proxy-lib"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -6360,7 +6360,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credential-proxy-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "nym-credentials",
@@ -6384,7 +6384,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credential-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6407,7 +6407,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credential-utils"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "log",
  "nym-bandwidth-controller",
@@ -6425,7 +6425,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credential-verification"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "bs58",
@@ -6453,7 +6453,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credentials"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "cosmrs",
@@ -6477,7 +6477,7 @@ dependencies = [
 
 [[package]]
 name = "nym-credentials-interface"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-bls12_381-fork",
  "nym-compact-ecash",
@@ -6495,7 +6495,7 @@ dependencies = [
 
 [[package]]
 name = "nym-crypto"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "aead",
  "aes",
@@ -6570,7 +6570,7 @@ dependencies = [
 
 [[package]]
 name = "nym-dkg"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bitvec",
  "bs58",
@@ -6592,7 +6592,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ecash-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bs58",
  "cosmwasm-schema",
@@ -6606,7 +6606,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ecash-signer-check"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "futures",
  "nym-ecash-signer-check-types",
@@ -6623,7 +6623,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ecash-signer-check-types"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-coconut-dkg-common",
  "nym-crypto",
@@ -6638,7 +6638,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ecash-time"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-compact-ecash",
  "time",
@@ -6646,7 +6646,7 @@ dependencies = [
 
 [[package]]
 name = "nym-exit-policy"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "reqwest 0.13.1",
  "serde",
@@ -6658,7 +6658,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ffi-shared"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "bs58",
@@ -6733,7 +6733,7 @@ dependencies = [
 
 [[package]]
 name = "nym-gateway-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "futures",
  "getrandom 0.2.16",
@@ -6771,7 +6771,7 @@ dependencies = [
 
 [[package]]
 name = "nym-gateway-probe"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -6824,7 +6824,7 @@ dependencies = [
 
 [[package]]
 name = "nym-gateway-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "bs58",
@@ -6856,7 +6856,7 @@ dependencies = [
 
 [[package]]
 name = "nym-gateway-stats-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "nym-node-metrics",
@@ -6872,7 +6872,7 @@ dependencies = [
 
 [[package]]
 name = "nym-gateway-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6891,7 +6891,7 @@ dependencies = [
 
 [[package]]
 name = "nym-go-ffi"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6908,7 +6908,7 @@ dependencies = [
 
 [[package]]
 name = "nym-group-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cw-controllers",
@@ -6919,7 +6919,7 @@ dependencies = [
 
 [[package]]
 name = "nym-http-api-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "bincode",
@@ -6952,7 +6952,7 @@ dependencies = [
 
 [[package]]
 name = "nym-http-api-client-macro"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-http-api-client",
  "proc-macro-crate",
@@ -6965,7 +6965,7 @@ dependencies = [
 
 [[package]]
 name = "nym-http-api-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "axum 0.7.9",
  "axum-client-ip",
@@ -6987,7 +6987,7 @@ dependencies = [
 
 [[package]]
 name = "nym-id"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-credential-storage",
  "nym-credentials",
@@ -7013,7 +7013,7 @@ dependencies = [
 
 [[package]]
 name = "nym-inclusion-probability"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "log",
  "rand 0.8.5",
@@ -7022,7 +7022,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ip-packet-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "bytes",
@@ -7038,7 +7038,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ip-packet-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "bytes",
@@ -7059,7 +7059,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ip-packet-router"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -7115,7 +7115,7 @@ dependencies = [
 
 [[package]]
 name = "nym-kkt"
-version = "0.1.0"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "libcrux-chacha20poly1305",
@@ -7138,7 +7138,7 @@ dependencies = [
 
 [[package]]
 name = "nym-kkt-ciphersuite"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "blake3",
  "libcrux-sha3",
@@ -7151,7 +7151,7 @@ dependencies = [
 
 [[package]]
 name = "nym-kkt-context"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "num_enum",
  "nym-kkt-ciphersuite",
@@ -7160,7 +7160,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ledger"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bip32",
  "k256",
@@ -7171,7 +7171,7 @@ dependencies = [
 
 [[package]]
 name = "nym-lp"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "bs58",
@@ -7230,7 +7230,7 @@ dependencies = [
 
 [[package]]
 name = "nym-metrics"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "dashmap",
  "lazy_static",
@@ -7240,7 +7240,7 @@ dependencies = [
 
 [[package]]
 name = "nym-mixnet-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "dashmap",
  "futures",
@@ -7257,7 +7257,7 @@ dependencies = [
 
 [[package]]
 name = "nym-mixnet-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bs58",
  "cosmwasm-schema",
@@ -7280,7 +7280,7 @@ dependencies = [
 
 [[package]]
 name = "nym-mixnode-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bytes",
  "futures",
@@ -7307,7 +7307,7 @@ dependencies = [
 
 [[package]]
 name = "nym-multisig-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cosmwasm-std",
@@ -7322,7 +7322,7 @@ dependencies = [
 
 [[package]]
 name = "nym-network-defaults"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cargo_metadata 0.19.2",
  "dotenvy",
@@ -7518,7 +7518,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node-metrics"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "dashmap",
  "futures",
@@ -7532,7 +7532,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "celes",
@@ -7658,7 +7658,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node-tester-utils"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "futures",
  "log",
@@ -7698,7 +7698,7 @@ dependencies = [
 
 [[package]]
 name = "nym-noise"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -7721,7 +7721,7 @@ dependencies = [
 
 [[package]]
 name = "nym-noise-keys"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-crypto",
  "schemars 0.8.22",
@@ -7731,7 +7731,7 @@ dependencies = [
 
 [[package]]
 name = "nym-nonexhaustive-delayqueue"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "tokio",
  "tokio-stream",
@@ -7757,7 +7757,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ordered-buffer"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "log",
  "thiserror 2.0.12",
@@ -7765,7 +7765,7 @@ dependencies = [
 
 [[package]]
 name = "nym-outfox"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "blake3",
  "chacha20",
@@ -7779,7 +7779,7 @@ dependencies = [
 
 [[package]]
 name = "nym-pemstore"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "pem",
  "tracing",
@@ -7788,7 +7788,7 @@ dependencies = [
 
 [[package]]
 name = "nym-performance-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cosmwasm-std",
@@ -7801,7 +7801,7 @@ dependencies = [
 
 [[package]]
 name = "nym-pool-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cosmwasm-std",
@@ -7814,7 +7814,7 @@ dependencies = [
 
 [[package]]
 name = "nym-registration-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "bytes",
@@ -7842,7 +7842,7 @@ dependencies = [
 
 [[package]]
 name = "nym-registration-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "nym-authenticator-requests",
@@ -7859,7 +7859,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sdk"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -7922,7 +7922,7 @@ dependencies = [
 
 [[package]]
 name = "nym-serde-helpers"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "base64 0.22.1",
  "bs58",
@@ -7933,7 +7933,7 @@ dependencies = [
 
 [[package]]
 name = "nym-service-provider-requests-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "serde",
@@ -7942,7 +7942,7 @@ dependencies = [
 
 [[package]]
 name = "nym-service-providers-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "log",
@@ -8008,7 +8008,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-client-core"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "dirs",
@@ -8040,7 +8040,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-proxy-helpers"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bytes",
  "futures",
@@ -8055,7 +8055,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-requests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "log",
@@ -8070,7 +8070,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-crypto",
  "nym-metrics",
@@ -8096,7 +8096,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-acknowledgements"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "generic-array 0.14.7",
  "nym-crypto",
@@ -8114,7 +8114,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-addressing"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bincode",
  "nym-crypto",
@@ -8127,7 +8127,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-anonymous-replies"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bs58",
  "nym-crypto",
@@ -8145,7 +8145,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-chunking"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "dashmap",
  "log",
@@ -8163,7 +8163,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-cover"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-crypto",
  "nym-sphinx-acknowledgements",
@@ -8180,7 +8180,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-forwarding"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-sphinx-addressing",
  "nym-sphinx-anonymous-replies",
@@ -8191,7 +8191,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-framing"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bytes",
  "cfg-if",
@@ -8208,7 +8208,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-params"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-crypto",
  "nym-sphinx-types",
@@ -8218,7 +8218,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-routing"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-sphinx-addressing",
  "nym-sphinx-types",
@@ -8227,7 +8227,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sphinx-types"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-outfox",
  "sphinx-packet",
@@ -8236,7 +8236,7 @@ dependencies = [
 
 [[package]]
 name = "nym-sqlx-pool-guard"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "proc_pidinfo",
  "sqlx",
@@ -8279,7 +8279,7 @@ dependencies = [
 
 [[package]]
 name = "nym-statistics-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "futures",
  "log",
@@ -8304,7 +8304,7 @@ dependencies = [
 
 [[package]]
 name = "nym-store-cipher"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -8319,7 +8319,7 @@ dependencies = [
 
 [[package]]
 name = "nym-task"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -8337,7 +8337,7 @@ dependencies = [
 
 [[package]]
 name = "nym-test-utils"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -8350,7 +8350,7 @@ dependencies = [
 
 [[package]]
 name = "nym-ticketbooks-merkle"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "nym-credentials-interface",
  "nym-serde-helpers",
@@ -8367,7 +8367,7 @@ dependencies = [
 
 [[package]]
 name = "nym-topology"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "nym-api-requests",
@@ -8389,7 +8389,7 @@ dependencies = [
 
 [[package]]
 name = "nym-tun"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "etherparse",
  "log",
@@ -8401,7 +8401,7 @@ dependencies = [
 
 [[package]]
 name = "nym-types"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "base64 0.22.1",
  "cosmrs",
@@ -8432,7 +8432,7 @@ dependencies = [
 
 [[package]]
 name = "nym-upgrade-mode-check"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "jwt-simple",
@@ -8450,7 +8450,7 @@ dependencies = [
 
 [[package]]
 name = "nym-validator-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8544,7 +8544,7 @@ dependencies = [
 
 [[package]]
 name = "nym-verloc"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "bytes",
  "futures",
@@ -8565,7 +8565,7 @@ dependencies = [
 
 [[package]]
 name = "nym-vesting-contract-common"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "cosmwasm-schema",
  "cosmwasm-std",
@@ -8599,7 +8599,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wasm-client-core"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "console_error_panic_hook",
@@ -8633,7 +8633,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wasm-storage"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "indexed_db_futures",
@@ -8647,7 +8647,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wasm-utils"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "console_error_panic_hook",
  "futures",
@@ -8663,7 +8663,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -8693,7 +8693,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard-private-metadata-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "nym-http-api-client",
@@ -8703,7 +8703,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard-private-metadata-server"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -8723,7 +8723,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard-private-metadata-shared"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "axum 0.7.9",
  "bincode",
@@ -8736,7 +8736,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard-private-metadata-tests"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "axum 0.7.9",
@@ -8760,7 +8760,7 @@ dependencies = [
 
 [[package]]
 name = "nym-wireguard-types"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "base64 0.22.1",
  "nym-crypto",
@@ -8851,7 +8851,7 @@ dependencies = [
 
 [[package]]
 name = "nyxd-scraper-shared"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -11165,7 +11165,7 @@ dependencies = [
 
 [[package]]
 name = "smolmix"
-version = "0.0.1"
+version = "1.21.0"
 dependencies = [
  "futures",
  "hickory-proto",
@@ -14624,7 +14624,7 @@ dependencies = [
 
 [[package]]
 name = "zknym-lib"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "async-trait",
  "js-sys",
@@ -14683,7 +14683,7 @@ dependencies = [
 
 [[package]]
 name = "zulip-client"
-version = "1.20.4"
+version = "1.21.0"
 dependencies = [
  "itertools 0.14.0",
  "nym-bin-common",
diff --git a/Cargo.toml b/Cargo.toml
index 1d1db9f1da..00c5e6d273 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -206,7 +206,7 @@ edition = "2024"
 license = "Apache-2.0"
 rust-version = "1.87.0"
 readme = "README.md"
-version = "1.20.4"
+version = "1.21.0"
 
 [workspace.dependencies]
 addr = "0.15.6"
@@ -349,7 +349,6 @@ serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
 sha2 = "0.10.3"
 si-scale = "0.2.3"
-smolmix = { version = "0.0.1", path = "smolmix/core" }
 smoltcp = "0.12"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
@@ -414,110 +413,112 @@ libcrux-sha3 = "0.0.8"
 libcrux-traits = "0.0.8"
 
 # Workspace dep definitions required by crates.io publication - we need a workspace version since `cargo workspaces` doesn't work with path imports from crate manifests
-nym-api-requests = { version = "1.20.4", path = "nym-api/nym-api-requests" }
-nym-authenticator-requests = { version = "1.20.4", path = "common/authenticator-requests" }
-nym-async-file-watcher = { version = "1.20.4", path = "common/async-file-watcher" }
-nym-authenticator-client = { version = "1.20.4", path = "nym-authenticator-client" }
-nym-bandwidth-controller = { version = "1.20.4", path = "common/bandwidth-controller" }
-nym-bin-common = { version = "1.20.4", path = "common/bin-common" }
-nym-cache = { version = "1.20.4", path = "common/nym-cache" }
-nym-client-core = { version = "1.20.4", path = "common/client-core", default-features = false }
-nym-client-core-config-types = { version = "1.20.4", path = "common/client-core/config-types" }
-nym-client-core-gateways-storage = { version = "1.20.4", path = "common/client-core/gateways-storage" }
-nym-client-core-surb-storage = { version = "1.20.4", path = "common/client-core/surb-storage" }
-nym-client-websocket-requests = { version = "1.20.4", path = "clients/native/websocket-requests" }
-nym-common = { version = "1.20.4", path = "common/nym-common" }
-nym-compact-ecash = { version = "1.20.4", path = "common/nym_offline_compact_ecash" }
-nym-config = { version = "1.20.4", path = "common/config" }
-nym-contracts-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/contracts-common" }
-nym-coconut-dkg-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
-nym-credential-storage = { version = "1.20.4", path = "common/credential-storage" }
-nym-credential-utils = { version = "1.20.4", path = "common/credential-utils" }
-nym-credential-proxy-lib = { version = "1.20.4", path = "common/credential-proxy" }
-nym-credentials = { version = "1.20.4", path = "common/credentials", default-features = false }
-nym-credentials-interface = { version = "1.20.4", path = "common/credentials-interface" }
-nym-credential-proxy-requests = { version = "1.20.4", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
-nym-credential-verification = { version = "1.20.4", path = "common/credential-verification" }
-nym-crypto = { version = "1.20.4", path = "common/crypto", default-features = false }
-nym-dkg = { version = "1.20.4", path = "common/dkg" }
-nym-ecash-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/ecash-contract" }
-nym-ecash-signer-check = { version = "1.20.4", path = "common/ecash-signer-check" }
-nym-ecash-signer-check-types = { version = "1.20.4", path = "common/ecash-signer-check-types" }
-nym-ecash-time = { version = "1.20.4", path = "common/ecash-time" }
-nym-exit-policy = { version = "1.20.4", path = "common/exit-policy" }
-nym-ffi-shared = { version = "1.20.4", path = "sdk/ffi/shared" }
-nym-gateway-client = { version = "1.20.4", path = "common/client-libs/gateway-client", default-features = false }
+nym-api-requests = { version = "1.21.0", path = "nym-api/nym-api-requests" }
+nym-authenticator-requests = { version = "1.21.0", path = "common/authenticator-requests" }
+nym-async-file-watcher = { version = "1.21.0", path = "common/async-file-watcher" }
+nym-authenticator-client = { version = "1.21.0", path = "nym-authenticator-client" }
+nym-bandwidth-controller = { version = "1.21.0", path = "common/bandwidth-controller" }
+nym-bin-common = { version = "1.21.0", path = "common/bin-common" }
+nym-cache = { version = "1.21.0", path = "common/nym-cache" }
+nym-client-core = { version = "1.21.0", path = "common/client-core", default-features = false }
+nym-client-core-config-types = { version = "1.21.0", path = "common/client-core/config-types" }
+nym-client-core-gateways-storage = { version = "1.21.0", path = "common/client-core/gateways-storage" }
+nym-client-core-surb-storage = { version = "1.21.0", path = "common/client-core/surb-storage" }
+nym-client-websocket-requests = { version = "1.21.0", path = "clients/native/websocket-requests" }
+nym-common = { version = "1.21.0", path = "common/nym-common" }
+nym-compact-ecash = { version = "1.21.0", path = "common/nym_offline_compact_ecash" }
+nym-config = { version = "1.21.0", path = "common/config" }
+nym-contracts-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/contracts-common" }
+nym-coconut-dkg-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/coconut-dkg" }
+nym-credential-storage = { version = "1.21.0", path = "common/credential-storage" }
+nym-credential-utils = { version = "1.21.0", path = "common/credential-utils" }
+nym-credential-proxy-lib = { version = "1.21.0", path = "common/credential-proxy" }
+nym-credentials = { version = "1.21.0", path = "common/credentials", default-features = false }
+nym-credentials-interface = { version = "1.21.0", path = "common/credentials-interface" }
+nym-credential-proxy-requests = { version = "1.21.0", path = "nym-credential-proxy/nym-credential-proxy-requests", default-features = false }
+nym-credential-verification = { version = "1.21.0", path = "common/credential-verification" }
+nym-crypto = { version = "1.21.0", path = "common/crypto", default-features = false }
+nym-dkg = { version = "1.21.0", path = "common/dkg" }
+nym-ecash-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/ecash-contract" }
+nym-ecash-signer-check = { version = "1.21.0", path = "common/ecash-signer-check" }
+nym-ecash-signer-check-types = { version = "1.21.0", path = "common/ecash-signer-check-types" }
+nym-ecash-time = { version = "1.21.0", path = "common/ecash-time" }
+nym-exit-policy = { version = "1.21.0", path = "common/exit-policy" }
+nym-ffi-shared = { version = "1.21.0", path = "sdk/ffi/shared" }
+nym-gateway-client = { version = "1.21.0", path = "common/client-libs/gateway-client", default-features = false }
 nym-gateway-probe = { version = "1.18.0", path = "nym-gateway-probe" }
-nym-gateway-requests = { version = "1.20.4", path = "common/gateway-requests" }
-nym-gateway-storage = { version = "1.20.4", path = "common/gateway-storage" }
-nym-gateway-stats-storage = { version = "1.20.4", path = "common/gateway-stats-storage" }
-nym-group-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/group-contract" }
-nym-http-api-client = { version = "1.20.4", path = "common/http-api-client" }
-nym-http-api-client-macro = { version = "1.20.4", path = "common/http-api-client-macro" }
-nym-http-api-common = { version = "1.20.4", path = "common/http-api-common", default-features = false }
-nym-id = { version = "1.20.4", path = "common/nym-id" }
-nym-ip-packet-client = { version = "1.20.4", path = "nym-ip-packet-client" }
-nym-ip-packet-requests = { version = "1.20.4", path = "common/ip-packet-requests" }
-nym-lp = { version = "1.20.4", path = "common/nym-lp" }
-nym-kkt = { version = "0.1.0", path = "common/nym-kkt" }
-nym-kkt-ciphersuite = { version = "1.20.4", path = "common/nym-kkt-ciphersuite" }
-nym-kkt-context = { version = "1.20.4", path = "common/nym-kkt-context" }
-nym-metrics = { version = "1.20.4", path = "common/nym-metrics" }
-nym-mixnet-client = { version = "1.20.4", path = "common/client-libs/mixnet-client" }
-nym-mixnet-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
-nym-multisig-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/multisig-contract" }
-nym-network-defaults = { version = "1.20.4", path = "common/network-defaults" }
-nym-node-tester-utils = { version = "1.20.4", path = "common/node-tester-utils" }
-nym-noise = { version = "1.20.4", path = "common/nymnoise" }
-nym-noise-keys = { version = "1.20.4", path = "common/nymnoise/keys" }
-nym-nonexhaustive-delayqueue = { version = "1.20.4", path = "common/nonexhaustive-delayqueue" }
-nym-node-requests = { version = "1.20.4", path = "nym-node/nym-node-requests", default-features = false }
-nym-node-metrics = { version = "1.20.4", path = "nym-node/nym-node-metrics" }
-nym-ordered-buffer = { version = "1.20.4", path = "common/socks5/ordered-buffer" }
-nym-outfox = { version = "1.20.4", path = "nym-outfox" }
-nym-registration-common = { version = "1.20.4", path = "common/registration" }
-nym-pemstore = { version = "1.20.4", path = "common/pemstore" }
-nym-performance-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
-nym-sdk = { version = "1.20.4", path = "sdk/rust/nym-sdk" }
-nym-serde-helpers = { version = "1.20.4", path = "common/serde-helpers" }
-nym-service-providers-common = { version = "1.20.4", path = "service-providers/common" }
-nym-service-provider-requests-common = { version = "1.20.4", path = "common/service-provider-requests-common" }
-nym-socks5-client-core = { version = "1.20.4", path = "common/socks5-client-core" }
-nym-socks5-proxy-helpers = { version = "1.20.4", path = "common/socks5/proxy-helpers" }
-nym-socks5-requests = { version = "1.20.4", path = "common/socks5/requests" }
-nym-sphinx = { version = "1.20.4", path = "common/nymsphinx" }
-nym-sphinx-acknowledgements = { version = "1.20.4", path = "common/nymsphinx/acknowledgements" }
-nym-sphinx-addressing = { version = "1.20.4", path = "common/nymsphinx/addressing" }
-nym-sphinx-anonymous-replies = { version = "1.20.4", path = "common/nymsphinx/anonymous-replies" }
-nym-sphinx-chunking = { version = "1.20.4", path = "common/nymsphinx/chunking" }
-nym-sphinx-cover = { version = "1.20.4", path = "common/nymsphinx/cover" }
-nym-sphinx-forwarding = { version = "1.20.4", path = "common/nymsphinx/forwarding" }
-nym-sphinx-framing = { version = "1.20.4", path = "common/nymsphinx/framing" }
-nym-sphinx-params = { version = "1.20.4", path = "common/nymsphinx/params" }
-nym-sphinx-routing = { version = "1.20.4", path = "common/nymsphinx/routing" }
-nym-sphinx-types = { version = "1.20.4", path = "common/nymsphinx/types" }
-nym-statistics-common = { version = "1.20.4", path = "common/statistics" }
-nym-store-cipher = { version = "1.20.4", path = "common/store-cipher" }
-nym-task = { version = "1.20.4", path = "common/task" }
-nym-tun = { version = "1.20.4", path = "common/tun" }
-nym-test-utils = { version = "1.20.4", path = "common/test-utils" }
-nym-ticketbooks-merkle = { version = "1.20.4", path = "common/ticketbooks-merkle" }
-nym-topology = { version = "1.20.4", path = "common/topology" }
-nym-types = { version = "1.20.4", path = "common/types" }
-nym-upgrade-mode-check = { version = "1.20.4", path = "common/upgrade-mode-check" }
-nym-validator-client = { version = "1.20.4", path = "common/client-libs/validator-client", default-features = false }
-nym-vesting-contract-common = { version = "1.20.4", path = "common/cosmwasm-smart-contracts/vesting-contract" }
-nym-verloc = { version = "1.20.4", path = "common/verloc" }
-nym-wireguard = { version = "1.20.4", path = "common/wireguard" }
-nym-wireguard-types = { version = "1.20.4", path = "common/wireguard-types" }
-nym-wireguard-private-metadata-shared = { version = "1.20.4", path = "common/wireguard-private-metadata/shared" }
-nym-wireguard-private-metadata-client = { version = "1.20.4", path = "common/wireguard-private-metadata/client" }
-nym-wireguard-private-metadata-server = { version = "1.20.4", path = "common/wireguard-private-metadata/server" }
+nym-gateway-requests = { version = "1.21.0", path = "common/gateway-requests" }
+nym-gateway-storage = { version = "1.21.0", path = "common/gateway-storage" }
+nym-gateway-stats-storage = { version = "1.21.0", path = "common/gateway-stats-storage" }
+nym-group-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/group-contract" }
+nym-http-api-client = { version = "1.21.0", path = "common/http-api-client" }
+nym-http-api-client-macro = { version = "1.21.0", path = "common/http-api-client-macro" }
+nym-http-api-common = { version = "1.21.0", path = "common/http-api-common", default-features = false }
+nym-id = { version = "1.21.0", path = "common/nym-id" }
+nym-ip-packet-client = { version = "1.21.0", path = "nym-ip-packet-client" }
+nym-ip-packet-requests = { version = "1.21.0", path = "common/ip-packet-requests" }
+nym-lp = { version = "1.21.0", path = "common/nym-lp" }
+nym-kkt = { version = "1.21.0", path = "common/nym-kkt" }
+nym-kkt-ciphersuite = { version = "1.21.0", path = "common/nym-kkt-ciphersuite" }
+nym-kkt-context = { version = "1.21.0", path = "common/nym-kkt-context" }
+nym-metrics = { version = "1.21.0", path = "common/nym-metrics" }
+nym-mixnet-client = { version = "1.21.0", path = "common/client-libs/mixnet-client" }
+nym-mixnet-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/mixnet-contract" }
+nym-multisig-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/multisig-contract" }
+nym-network-defaults = { version = "1.21.0", path = "common/network-defaults" }
+nym-node-tester-utils = { version = "1.21.0", path = "common/node-tester-utils" }
+nym-noise = { version = "1.21.0", path = "common/nymnoise" }
+nym-noise-keys = { version = "1.21.0", path = "common/nymnoise/keys" }
+nym-nonexhaustive-delayqueue = { version = "1.21.0", path = "common/nonexhaustive-delayqueue" }
+nym-node-requests = { version = "1.21.0", path = "nym-node/nym-node-requests", default-features = false }
+nym-node-metrics = { version = "1.21.0", path = "nym-node/nym-node-metrics" }
+nym-ordered-buffer = { version = "1.21.0", path = "common/socks5/ordered-buffer" }
+nym-outfox = { version = "1.21.0", path = "nym-outfox" }
+nym-registration-common = { version = "1.21.0", path = "common/registration" }
+nym-pemstore = { version = "1.21.0", path = "common/pemstore" }
+nym-performance-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/nym-performance-contract" }
+nym-sdk = { version = "1.21.0", path = "sdk/rust/nym-sdk" }
+nym-serde-helpers = { version = "1.21.0", path = "common/serde-helpers" }
+nym-service-providers-common = { version = "1.21.0", path = "service-providers/common" }
+nym-service-provider-requests-common = { version = "1.21.0", path = "common/service-provider-requests-common" }
+nym-socks5-client-core = { version = "1.21.0", path = "common/socks5-client-core" }
+nym-socks5-proxy-helpers = { version = "1.21.0", path = "common/socks5/proxy-helpers" }
+nym-socks5-requests = { version = "1.21.0", path = "common/socks5/requests" }
+nym-sphinx = { version = "1.21.0", path = "common/nymsphinx" }
+nym-sphinx-acknowledgements = { version = "1.21.0", path = "common/nymsphinx/acknowledgements" }
+nym-sphinx-addressing = { version = "1.21.0", path = "common/nymsphinx/addressing" }
+nym-sphinx-anonymous-replies = { version = "1.21.0", path = "common/nymsphinx/anonymous-replies" }
+nym-sphinx-chunking = { version = "1.21.0", path = "common/nymsphinx/chunking" }
+nym-sphinx-cover = { version = "1.21.0", path = "common/nymsphinx/cover" }
+nym-sphinx-forwarding = { version = "1.21.0", path = "common/nymsphinx/forwarding" }
+nym-sphinx-framing = { version = "1.21.0", path = "common/nymsphinx/framing" }
+nym-sphinx-params = { version = "1.21.0", path = "common/nymsphinx/params" }
+nym-sphinx-routing = { version = "1.21.0", path = "common/nymsphinx/routing" }
+nym-sphinx-types = { version = "1.21.0", path = "common/nymsphinx/types" }
+nym-statistics-common = { version = "1.21.0", path = "common/statistics" }
+nym-store-cipher = { version = "1.21.0", path = "common/store-cipher" }
+nym-task = { version = "1.21.0", path = "common/task" }
+nym-tun = { version = "1.21.0", path = "common/tun" }
+nym-test-utils = { version = "1.21.0", path = "common/test-utils" }
+nym-ticketbooks-merkle = { version = "1.21.0", path = "common/ticketbooks-merkle" }
+nym-topology = { version = "1.21.0", path = "common/topology" }
+nym-types = { version = "1.21.0", path = "common/types" }
+nym-upgrade-mode-check = { version = "1.21.0", path = "common/upgrade-mode-check" }
+nym-validator-client = { version = "1.21.0", path = "common/client-libs/validator-client", default-features = false }
+nym-vesting-contract-common = { version = "1.21.0", path = "common/cosmwasm-smart-contracts/vesting-contract" }
+nym-verloc = { version = "1.21.0", path = "common/verloc" }
+nym-wireguard = { version = "1.21.0", path = "common/wireguard" }
+nym-wireguard-types = { version = "1.21.0", path = "common/wireguard-types" }
+nym-wireguard-private-metadata-shared = { version = "1.21.0", path = "common/wireguard-private-metadata/shared" }
+nym-wireguard-private-metadata-client = { version = "1.21.0", path = "common/wireguard-private-metadata/client" }
+nym-wireguard-private-metadata-server = { version = "1.21.0", path = "common/wireguard-private-metadata/server" }
 nym-sqlx-pool-guard = { version = "1.2.0", path = "nym-sqlx-pool-guard" }
-nym-wasm-client-core = { version = "1.20.4", path = "common/wasm/client-core" }
-nym-wasm-storage = { version = "1.20.4", path = "common/wasm/storage" }
-nym-wasm-utils = { version = "1.20.4", path = "common/wasm/utils", default-features = false }
-nyxd-scraper-shared = { version = "1.20.4", path = "common/nyxd-scraper-shared" }
+nym-wasm-client-core = { version = "1.21.0", path = "common/wasm/client-core" }
+nym-wasm-storage = { version = "1.21.0", path = "common/wasm/storage" }
+nym-wasm-utils = { version = "1.21.0", path = "common/wasm/utils", default-features = false }
+nyxd-scraper-shared = { version = "1.21.0", path = "common/nyxd-scraper-shared" }
+
+smolmix = { version = "1.21.0", path = "smolmix/core" }
 
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/nym-bls12_381-fork/issues/10 is resolved, we have to rely on the fork
diff --git a/common/ip-packet-requests/src/lib.rs b/common/ip-packet-requests/src/lib.rs
index eb1ef05086..5c93dad297 100644
--- a/common/ip-packet-requests/src/lib.rs
+++ b/common/ip-packet-requests/src/lib.rs
@@ -28,7 +28,7 @@ mod tests {
     fn stream_transport_threshold_is_consistent() {
         assert_eq!(MAX_NON_STREAM_VERSION, 8);
         assert_eq!(SPHINX_STREAM_VERSION_THRESHOLD, 9);
-        assert!(SPHINX_STREAM_VERSION_THRESHOLD > MAX_NON_STREAM_VERSION);
+        const _: () = assert!(SPHINX_STREAM_VERSION_THRESHOLD > MAX_NON_STREAM_VERSION);
     }
 }
 
diff --git a/common/nym-kkt/Cargo.toml b/common/nym-kkt/Cargo.toml
index e278e33887..1157ee3869 100644
--- a/common/nym-kkt/Cargo.toml
+++ b/common/nym-kkt/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "nym-kkt"
 description = "Key transport protocol for the Nym network"
-version = "0.1.0"
+version = "1.21.0"
 authors = ["Georgio Nicolas <georgio@nymtech.net>"]
 edition = { workspace = true }
 license.workspace = true
diff --git a/crate-publishing.md b/crate-publishing.md
index 86dc0988d2..037143712d 100644
--- a/crate-publishing.md
+++ b/crate-publishing.md
@@ -1,34 +1,67 @@
 # Publishing workspace dependencies
+
 ## Rationale re: versioning
+
 We publish the majority of our workspace dependencies (essentially everything in the repo aside from binaries, smart contracts, and some internal tooling) to [crates.io](https://crates.io).
 
-In order to make this easy to maintain, the versions of these workspace dependencies and the `nym-sdk` crate are kept in sync.
+In order to make this easy to maintain, the versions of these workspace dependencies and the `nym-sdk` crate are kept in sync. The same is done to newer crates such as `smolmix`.
 
 This version is defined in the `[workspace.package]` section of the root monorepo `Cargo.toml` file. Each of the workspace dependencies have their paths and versions (this has to be individually defined at the moment per-dependency, **this version needs to stay the same as the `workspace.package` version**) defined in the `[workspace.dependencies]` section of the root monorepo `Cargo.toml` file.
 
+The `contracts/` directory has its own separate `[workspace]`. Those crates are CosmWasm smart contracts deployed as WASM to chain, not published to crates.io. The shared types between the two workspaces (e.g. `nym-contracts-common`) live in `common/cosmwasm-smart-contracts/` within the root workspace and are published. The contracts workspace depends on them from crates.io.
+
 ## When Developing
+
 If you add a workspace dependency to the SDK when developing, make sure to add this to the workspace dependencies in the root monorepo `Cargo.toml`.
 
+Crates that should not be published to crates.io must have `publish = false` in their `Cargo.toml`. The preflight check (`tools/internal/check_publish_preflight.py`) will flag publishable crates with missing metadata.
+
 ## Check local publication
+
 ```
 # List crates to publish
 cargo workspaces list
 
+# Check publishability (metadata, deps, non-publishable chains)
+python3 tools/internal/check_publish_preflight.py
+
 # Dry run locally - check for compilation or other problems
 cargo workspaces publish --no-git-commit --dry-run
 ```
 
 ## CI
-There are several workflows that should be run in the following order:
-- `ci-crates-publish-dry-run`: **run this first!** This is a remote dry-run on a runner. This greps for any errors that would be a problem when we're not dry-running. It doesn't catch all errors, as `dry-run` has a known issue where, assuming that 2 new crates are being uploaded, and crate B relies on crate A, if crate A isn't on crates.io (which it won't be, since you're dry-running publication), then since `cargo workspaces publish` only checks for available versions on crates.io, it will error. We don't want the CI to fail in that case.
-- `ci-crates-version-bump`: this bumps the versions of the workspace + dependencies to the passed version, and then commits the change. This is its own CI job so that we don't get into sticky situations whereby the version bump + commit happens, but the publication step fails.
-- `ci-crates-publish`: this publishes the crates. So long as you're not uploading more than 5 new crates, pass `60` as the `publish_interval`. This is to get around [crates.io rate limiting](https://github.com/rust-lang/crates.io/blob/ad7e58e1afd65b9137e58a7bca3e1fb7f5546682/src/rate_limiter.rs#L24). Pass the Github handle of whoever should be the backup author of the crate for security redundency (see the section below) as the second arg.
 
-> There is also `ci-crates-publish-resume` which is there in case a publication run fails and needs to be restarted part way through the list of unbumped/unpublished crates. Pass the previously bumped/published crate in the list output of `cargo workspaces list`
+There are several workflows that should be run in the following order:
+
+1. **`ci-crates-publish-dry-run`**: Run this first. This is a remote dry-run on a runner that greps for real packaging errors (manifest issues, missing metadata). It ignores cascading dependency errors, which are expected in dry-run mode because upstream crates aren't actually uploaded to crates.io.
+
+2. **`ci-crates-version-bump`**: Bumps the versions of the workspace + dependencies to the passed version. This is a separate job so that if the version bump succeeds but publication fails, the versions aren't left in a bad state. **This creates a PR that must be merged into the branch you're publishing from before running publish.**
+
+3. **`ci-crates-publish`**: Publishes the crates using `cargo workspaces publish --publish-as-is`. The `--publish-as-is` flag tells cargo-workspaces to publish with the current versions in the repo (already bumped by step 2) without doing any version changes itself.
+
+   - `publish_interval`: seconds to wait between publishes for crates.io indexing. Use `600` for first-time publication of many new crates, `60` after that. This is to get around [crates.io rate limiting](https://github.com/rust-lang/crates.io/blob/ad7e58e1afd65b9137e58a7bca3e1fb7f5546682/src/rate_limiter.rs#L24).
+   - `backup_author`: Github handle of who should be added as backup crate owner (defaults to `jstuczyn`).
+
+> There is also `ci-crates-publish-resume` which is there in case a publication run fails and needs to be restarted part way through the list of unpublished crates.
+
+### Important: workflow sequencing
+
+The version-bump workflow creates a PR due to branch protection rules. **You must merge that PR before running the publish workflow**, otherwise publish will run against the unbumped branch and fail with "already exists" errors for the old version.
+
+## How cargo-workspaces publish works
+
+`cargo workspaces publish` handles several things that raw `cargo publish` does not:
+
+- **Topological ordering**: publishes crates in dependency order.
+- **Dev-dep removal**: by default, dev-dependencies are stripped from each crate's `Cargo.toml` before publishing. This avoids packaging failures where a dev-dep on a workspace sibling hasn't been uploaded yet.
+- **Cargo.toml rewriting**: replaces `workspace = true` references with concrete values before calling `cargo publish`.
+
+Do not replace this with a manual `cargo publish -p` loop -- it will fail during packaging because `cargo publish` tries to resolve all deps (including dev-deps) against the crates.io index, and workspace siblings at the new version won't exist yet.
 
 ## Crates.io Authors
-Since Github teams have [limited ownership / mod rights](https://doc.rust-lang.org/cargo/reference/publishing.html#cargo-owner) of crates, and we cannot create a `CARGO_REGISTRY_TOKEN` on behalf of the Nym Github org. As such, we are currently using personal cargo tokens generated by team members (currently Max), and adding the Nym Github org as an owner in the CI job.
 
-However, since the Github org cannot add or modify owners, are also adding a second user author as a redundency, on the offchance that Max loses access to his Crates.io / Github account, gets struck by lightning, etc. This is the author passed as the second argument to the `ci-crates-publish` CI, and if none is passed, defaults to [https://github.com/jstuczyn](https://github.com/jstuczyn) since he is the Github org owner.
+Since Github teams have [limited ownership / mod rights](https://doc.rust-lang.org/cargo/reference/publishing.html#cargo-owner) of crates, and we cannot create a `CARGO_REGISTRY_TOKEN` on behalf of the Nym Github org, we are currently using personal cargo tokens generated by team members (currently Max), and adding the Nym Github org as an owner in the CI job.
+
+However, since the Github org cannot add or modify owners, we are also adding a second user as a redundancy, on the offchance that Max loses access to his Crates.io / Github account, gets struck by lightning, etc. This is the author passed as the second argument to the `ci-crates-publish` CI, and if none is passed, defaults to [jstuczyn](https://github.com/jstuczyn) since he is the Github org owner.
 
 Authors can also be changed by running `scripts/add-crates-owners.sh`.
diff --git a/nym-registration-client/Cargo.toml b/nym-registration-client/Cargo.toml
index 0a7e845864..9e5082689f 100644
--- a/nym-registration-client/Cargo.toml
+++ b/nym-registration-client/Cargo.toml
@@ -38,4 +38,4 @@ nym-wireguard-types = { path = "../common/wireguard-types" }
 
 [dev-dependencies]
 nym-kkt.workspace = true
-nym-test-utils.workspace = true
\ No newline at end of file
+nym-test-utils.workspace = true
diff --git a/service-providers/ip-packet-router/src/messages/response.rs b/service-providers/ip-packet-router/src/messages/response.rs
index e928487a26..deefccc146 100644
--- a/service-providers/ip-packet-router/src/messages/response.rs
+++ b/service-providers/ip-packet-router/src/messages/response.rs
@@ -133,8 +133,7 @@ impl VersionedResponse {
             ClientVersion::V9 => {
                 let mut resp = IpPacketResponseV8::try_from(self)?;
                 resp.version = nym_ip_packet_requests::v9::VERSION;
-                let bytes = resp.to_bytes();
-                bytes
+                resp.to_bytes()
             }
         }
         .map_err(|err| IpPacketRouterError::FailedToSerializeResponsePacket { source: err })
diff --git a/smolmix/core/Cargo.toml b/smolmix/core/Cargo.toml
index 9ef598b42d..2fe8ac0fca 100644
--- a/smolmix/core/Cargo.toml
+++ b/smolmix/core/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "smolmix"
 description = "Tunnel for TCP and UDP traffic to be sent over Nym mixnet to clearnet remote hosts"
-version = "0.0.1"
+version.workspace = true
 authors.workspace = true
 edition = "2021"
 license.workspace = true