diff --git a/.changeset/cold-forks-worry.md b/.changeset/cold-forks-worry.md
new file mode 100644
index 0000000..fce36b6
--- /dev/null
+++ b/.changeset/cold-forks-worry.md
@@ -0,0 +1,5 @@
+---
+"@powersync/sql-js": patch
+---
+
+Use trusted publishing to publish this package.
diff --git a/.changeset/grumpy-shrimps-wear.md b/.changeset/grumpy-shrimps-wear.md
new file mode 100644
index 0000000..4738f94
--- /dev/null
+++ b/.changeset/grumpy-shrimps-wear.md
@@ -0,0 +1,5 @@
+---
+"@powersync/sql-js": patch
+---
+
+Update PowerSync core extension to version 0.4.8.
diff --git a/.github/workflows/build-package.yaml b/.github/workflows/build-package.yaml
index c14e85b..64b444d 100644
--- a/.github/workflows/build-package.yaml
+++ b/.github/workflows/build-package.yaml
@@ -9,27 +9,26 @@ jobs:
     name: Build Packages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
 
-      - name: Setup NodeJS
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"
-
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@v4
         name: Install pnpm
         with:
-          version: 9
           run_install: false
 
+      - name: Setup NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: ".nvmrc"
+
       - name: Get pnpm store directory
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         name: Setup pnpm cache
         with:
           path: ${{ env.STORE_PATH }}
diff --git a/.github/workflows/dev-packages.yaml b/.github/workflows/dev-packages.yaml
deleted file mode 100644
index da611ca..0000000
--- a/.github/workflows/dev-packages.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-# Action to publish packages under the `next` tag for testing
-# Packages are versioned as `0.0.0-{tag}-DATETIMESTAMP`
-name: Create Dev Release
-
-on: workflow_dispatch
-
-jobs:
-  publish:
-    name: Publish Dev Packages
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Setup NodeJS
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"
-      - uses: pnpm/action-setup@v2
-        name: Install pnpm
-        with:
-          version: 9
-          run_install: false
-      - name: Add NPM auth
-        run: echo "//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}" >> ~/.npmrc
-      - name: Get pnpm store directory
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-      - uses: actions/cache@v3
-        name: Setup pnpm cache
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Install sha3sum
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libdigest-sha3-perl
-
-      - name: Setup Emscripten
-        uses: mymindstorm/setup-emsdk@v14
-        with:
-          version: 4.0.10
-          actions-cache-folder: "emsdk-cache"
-
-      - name: Build
-        run: pnpm build
-
-      - name: Publish
-        run: |
-          pnpm changeset version --no-git-tag --snapshot dev
-          pnpm changeset publish --tag dev
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae289db..1b9e619 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,32 +4,36 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    # Dev publishing
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v4
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"
-      - uses: pnpm/action-setup@v2
+        uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4
         name: Install pnpm
         with:
-          # Pnpm 9.4 introduces this https://github.com/pnpm/pnpm/pull/7633
-          # which causes workspace:^1.2.0 to be converted to 1.2.0^1.2.0
-          version: 9.3
           run_install: false
+
+      - name: Setup NodeJS
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: ".nvmrc"
       - name: Get pnpm store directory
         shell: bash
         run: |
           echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         name: Setup pnpm cache
         with:
           path: ${{ env.STORE_PATH }}
@@ -50,9 +54,13 @@ jobs:
           version: 4.0.10
           actions-cache-folder: "emsdk-cache"
 
+      - name: Build
+        run: pnpm build
+
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
+        if: ${{ github.event_name == 'push' }}
         with:
           # Update the monorepo lockfile after versioning
           version: pnpm changeset:version
@@ -60,4 +68,11 @@ jobs:
           publish: pnpm release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Dev publish
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          pnpm changeset version --no-git-tag --snapshot dev
+          pnpm changeset publish --tag dev
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/build.sh b/build.sh
index db09137..a1f6d32 100755
--- a/build.sh
+++ b/build.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 set -e
 
-POWERSYNC_CORE_VERSION="0.4.6"
+POWERSYNC_CORE_VERSION="0.4.8"
 SQLITE_PATH="sql.js"
 
 if [ -d "$SQLITE_PATH" ]; then
diff --git a/package.json b/package.json
index e9d286f..ee99cc0 100644
--- a/package.json
+++ b/package.json
@@ -30,5 +30,6 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.29.5"
-  }
+  },
+  "packageManager": "pnpm@10.19.0+sha512.c9fc7236e92adf5c8af42fd5bf1612df99c2ceb62f27047032f4720b33f8eacdde311865e91c411f2774f618d82f320808ecb51718bfa82c060c4ba7c76a32b8"
 }