diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 22d477b..143c148 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,25 +19,25 @@ jobs:
   build_pypi_and_docker:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0 # unshallow checkout enables setuptools_scm to infer PyPi version from Git
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v6
       with:
-        python-version: '3.7'
+        python-version: '3.12'
 
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install build
+        pip install build setuptools
 
     - name: Build Package
       run: python -m build
 
     - name: Upload Wheel Artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: netfoundry-wheel-${{ github.run_id }}
         path: dist/netfoundry-*.whl
@@ -72,12 +72,15 @@ jobs:
         register-python-argcomplete nfctl
 
     - name: Run the NF CLI demo to  test installed version
+      shell: bash
       env:
         NETFOUNDRY_CLIENT_ID: ${{ secrets.NETFOUNDRY_CLIENT_ID }}
         NETFOUNDRY_PASSWORD: ${{ secrets.NETFOUNDRY_PASSWORD }}
         NETFOUNDRY_OAUTH_URL: ${{ secrets.NETFOUNDRY_OAUTH_URL }}
       run: |
-        set -x
+        set -o xtrace
+        set -o pipefail
+
         nfctl config \
           general.network=$(nfctl demo --echo-name --prefix 'gh-${{ github.run_id }}') \
           general.yes=True \
@@ -98,7 +101,7 @@ jobs:
           delete network
 
     - name: Publish Test Package
-      uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
+      uses: pypa/gh-action-pypi-publish@v1.13.0
       with:
         user: __token__
         password: ${{ secrets.TEST_PYPI_API_TOKEN }}
@@ -120,21 +123,21 @@ jobs:
 
     - name: Publish Release to PyPi
       if: github.event.action == 'published'
-      uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
+      uses: pypa/gh-action-pypi-publish@v1.13.0
       with:
         user: __token__
         password: ${{ secrets.PYPI_API_TOKEN }}
 
     - name: Attach Wheel Artifact to GH Release
       if: ${{ github.event.action == 'published' }}
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       with:
         files: dist/netfoundry-*.whl
         fail_on_unmatched_files: true
         generate_release_notes: true
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@master
+      uses: docker/setup-qemu-action@v3
       with:
         platforms: amd64,arm64
         # ignore arm/v7 (32bit) because unsupported by "cryptography" dep of
@@ -142,16 +145,16 @@ jobs:
 
     - name: Set up Docker BuildKit
       id: buildx
-      uses: docker/setup-buildx-action@master
+      uses: docker/setup-buildx-action@v3
 
     - name: Login to Docker Hub
-      uses: docker/login-action@v1
+      uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_HUB_API_USER }}
         password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
 
     - name: Build & Push Multi-Platform Container
-      uses: docker/build-push-action@v2
+      uses: docker/build-push-action@v6
       with:
         context: ${{ github.workspace }} # build context is workspace so we can copy artifacts from ./dist/
         file: ${{ github.workspace }}/docker/Dockerfile
diff --git a/docker/Dockerfile b/docker/Dockerfile
index edf66fa..6db8e49 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.9-slim-buster
+FROM python:3.12-slim-bookworm
 COPY ./dist/netfoundry-*.whl /tmp/
 RUN pip install --upgrade pip
 RUN pip install /tmp/netfoundry-*.whl
diff --git a/netfoundry/ctl.py b/netfoundry/ctl.py
index 34fe585..ddca9c8 100644
--- a/netfoundry/ctl.py
+++ b/netfoundry/ctl.py
@@ -25,7 +25,7 @@
 from xml.sax.xmlreader import InputSource
 
 from jwt.exceptions import PyJWTError
-from milc import set_metadata  # this function needed to set metadata immediately below
+# milc metadata will be set after cli import
 from pygments import highlight
 from pygments.formatters import Terminal256Formatter
 from pygments.lexers import get_lexer_by_name, load_lexer_from_file
@@ -42,10 +42,10 @@
 from .organization import Organization
 from .utility import DC_PROVIDERS, EMBED_NET_RESOURCES, IDENTITY_ID_PROPERTIES, MUTABLE_NET_RESOURCES, MUTABLE_RESOURCE_ABBREV, RESOURCE_ABBREV, RESOURCES, any_in, get_generic_resource_by_type_and_id, normalize_caseless, plural, propid2type, singular
 
-# must precend import milc.cli
-set_metadata(version=f"v{netfoundry_version}", author="NetFoundry", name="nfctl")
-# this uses metadata set above
+# import milc cli
 from milc import cli, questions  # noqa: E402
+# set milc options using new API
+cli.milc_options(name='nfctl', author='NetFoundry', version=f'v{netfoundry_version}')
 # this creates the config subcommand
 from milc.subcommand import config  # noqa: F401,E402
 
@@ -871,7 +871,7 @@ def delete(cli):
             sysexit(1)
 
 
-@cli.argument("-p", "--prefix", default=f"{cli.prog_name}-demo", help="choose a network name prefix to identify all of your demos")
+@cli.argument("-p", "--prefix", default="nfctl-demo", help="choose a network name prefix to identify all of your demos")
 @cli.argument("-j", "--jwt", action="store_boolean", default=True, help="save the one-time enroll token for each demo identity in the current directory")
 @cli.argument("-e", "--echo-name", arg_only=True, action="store_true", default=False, help="only echo a friendly network name then exit")
 @cli.argument("-s", "--size", default="medium", help=argparse.SUPPRESS)   # troubleshoot scale-up instance size factor