diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2524559..6d3604f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,13 +1,56 @@
 name: Java CI Combined
 
-on: [push, pull_request, workflow_dispatch]
+# Push publishes the -SNAPSHOT version already in pom.xml to the Sonatype snapshot repo (and S3, until the cut-off).
+# A manual run picks a type: release (default) X.Y.Z.N, rc X.Y.Z.N-RC, beta X.Y.Z.N-BETA, alpha X.Y.Z.N-ALPHA
+# (N from the -SNAPSHOT in pom.xml), then commits the next -SNAPSHOT. Type "snapshot" only deploys the current snapshot.
+# Where each version goes:
+#   final (X.Y.Z.N) and -SNAPSHOT: mvn deploy (Maven Central / snapshot repo) + S3 Maven layout
+#   -RC, -BETA, -ALPHA:            mvn install (signed), S3 Maven layout only (maven.lucee-services.com), never Central
+# A push to a branch with a -SNAPSHOT version also commits the next -SNAPSHOT after the deploy,
+# so every commit gets its own build number. The bump commit itself does not bump again.
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      type:
+        description: 'What to publish: release (X.Y.Z.N), rc (-RC), beta (-BETA), alpha (-ALPHA), or snapshot (deploy the current -SNAPSHOT, no bump)'
+        type: choice
+        options:
+          - release
+          - rc
+          - beta
+          - alpha
+          - snapshot
+        default: release
 
 jobs:
   setup:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.extract-version.outputs.VERSION }}
+      release: ${{ steps.extract-version.outputs.RELEASE }}
+      next_version: ${{ steps.extract-version.outputs.NEXT_VERSION }}
+      lucee_matrix: ${{ steps.lucee-matrix.outputs.MATRIX }}
+      publish: ${{ steps.publish.outputs.PUBLISH }}
     steps:
+      # Only pushes and manual runs on master/main, a version branch (1.0, 2.0, ...) or release/* may
+      # publish (deploy, s3) or commit (bump). Feature and PR branches only build and test.
+      - name: Decide whether this run may publish
+        id: publish
+        env:
+          EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+        run: |
+          PUBLISH=false
+          if [[ "$EVENT" == "push" || "$EVENT" == "workflow_dispatch" ]]; then
+            BRANCH="${REF#refs/heads/}"
+            if [[ "$REF" == refs/heads/* ]] && [[ "$BRANCH" == "master" || "$BRANCH" == "main" || "$BRANCH" =~ ^[0-9]+(\.[0-9]+)*$ || "$BRANCH" == release/* ]]; then
+              PUBLISH=true
+            fi
+          fi
+          echo "event=${EVENT} ref=${REF} publish=${PUBLISH}"
+          echo "PUBLISH=${PUBLISH}" >> "$GITHUB_OUTPUT"
       - name: Checkout repository
         uses: actions/checkout@v4
 
@@ -21,15 +64,105 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.m2
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          key: ${{ runner.os }}-maven-v2-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
-            ${{ runner.os }}-maven-
+            ${{ runner.os }}-maven-v2-
 
       - name: Extract version number
         id: extract-version
+        env:
+          # A manual run releases unless the box is unticked. Push and pull_request never do.
+          RELEASE_TYPE: ${{ github.event_name == 'workflow_dispatch' && inputs.type || 'snapshot' }}
         run: |
-          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
-          echo "::set-output name=VERSION::$VERSION"
+          set -euo pipefail
+          VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout | tr -d '\r')
+          RELEASE=false
+          NEXT_VERSION=""
+          case "$RELEASE_TYPE" in
+            release) SUFFIX="" ;;
+            rc) SUFFIX="-RC" ;;
+            beta) SUFFIX="-BETA" ;;
+            alpha) SUFFIX="-ALPHA" ;;
+            snapshot) SUFFIX="none" ;;
+            *) echo "::error::unknown release type [${RELEASE_TYPE}]"; exit 1 ;;
+          esac
+          if [[ "$SUFFIX" != "none" ]]; then
+            if [[ "$VERSION" != *-SNAPSHOT ]]; then
+              echo "::error::A release run needs a -SNAPSHOT version in pom.xml (found ${VERSION})"
+              exit 1
+            fi
+            RELEASE_VERSION="${VERSION%-SNAPSHOT}"
+            if ! [[ "$RELEASE_VERSION" =~ ^[0-9]+(\.[0-9]+){3}$ ]]; then
+              echo "::error::[${RELEASE_VERSION}] is not a 4-part release version"
+              exit 1
+            fi
+            PREFIX="${RELEASE_VERSION%.*}"
+            LAST="${RELEASE_VERSION##*.}"
+            NEXT_VERSION="${PREFIX}.$((10#$LAST + 1))-SNAPSHOT"
+            VERSION="${RELEASE_VERSION}${SUFFIX}"
+            if ! [[ "$VERSION" =~ ^[0-9]+(\.[0-9]+){3}(-RC|-BETA|-ALPHA)?$ ]]; then
+              echo "::error::[${VERSION}] is not a valid release version"
+              exit 1
+            fi
+            RELEASE=true
+            echo "Release run: publish ${VERSION}, then bump pom.xml to ${NEXT_VERSION}"
+          fi
+          echo "Using VERSION=${VERSION} RELEASE=${RELEASE} NEXT_VERSION=${NEXT_VERSION}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "RELEASE=${RELEASE}" >> "$GITHUB_OUTPUT"
+          echo "NEXT_VERSION=${NEXT_VERSION}" >> "$GITHUB_OUTPUT"
+
+      # Repository and organization variables are not passed to pull_request runs from forks, so
+      # vars.LUCEE_TEST_VERSIONS_7 is empty there and fromJSON('') fails the whole run before build-and-test starts.
+      # Use the variable when it is set, otherwise test the latest build of each Lucee line through
+      # a version query (script-runner resolves it), so fork PRs are tested too.
+      - name: Resolve Lucee test matrix
+        id: lucee-matrix
+        env:
+          TEST_VERSIONS: ${{ vars.LUCEE_TEST_VERSIONS_7 }}
+          # this extension needs Lucee 7.1.0.204 or newer (luceeCoreVersion in pom.xml)
+          FALLBACK_LINES: "7.1 8.0"
+          REQUIRED_LINES: ""
+        run: |
+          set -euo pipefail
+          if [[ -n "${TEST_VERSIONS// }" ]] && echo "$TEST_VERSIONS" | jq -e 'type == "array" and length > 0' > /dev/null; then
+            echo "Using vars.LUCEE_TEST_VERSIONS_7"
+            MATRIX=$(echo "$TEST_VERSIONS" | jq -c '.')
+          else
+            echo "::notice::vars.LUCEE_TEST_VERSIONS_7 is not available (fork pull request?), testing the latest build of: ${FALLBACK_LINES}"
+            MATRIX=$(printf '%s\n' $FALLBACK_LINES | jq -R -s -c 'split("\n") | map(select(length > 0)) | map({version: (. + "/all/light"), query: (. + "/all/light")})')
+          fi
+          for LINE in $REQUIRED_LINES; do
+            if ! echo "$MATRIX" | jq -e --arg l "$LINE" 'any(.[]; ((.query // "") | startswith($l + "/")) or ((.version // "") | test("^[a-z]*-?" + ($l | gsub("\\."; "\\.")) + "\\.")))' > /dev/null; then
+              echo "Adding the latest ${LINE} build to the matrix"
+              MATRIX=$(echo "$MATRIX" | jq -c --arg l "$LINE" '. + [{version: ($l + "/all/light"), query: ($l + "/all/light")}]')
+            fi
+          done
+          # also test the oldest supported core, luceeCoreVersion from pom.xml (Lucee jar from the CDN)
+          MIN_VERSION=$(mvn -B help:evaluate -Dexpression=luceeCoreVersion -q -DforceStdout | tr -d '\r')
+          if ! [[ "$MIN_VERSION" =~ ^[0-9]+(\.[0-9]+){3}(-[A-Z]+)?$ ]]; then
+            echo "::error::[${MIN_VERSION}] is not a valid luceeCoreVersion"
+            exit 1
+          fi
+          # drop entries older than luceeCoreVersion: a version is compared in full, a line (7.0/...) by major.minor
+          MATRIX=$(echo "$MATRIX" | jq -c --arg min "${MIN_VERSION%%-*}" '
+            def nums: [scan("[0-9]+") | tonumber];
+            ($min | nums) as $m
+            | map(select(
+                ([(.version // ""), (.query // "")] | map([match("[0-9]+(\\.[0-9]+){1,3}").string]) | add | first // "") as $v
+                | if $v == "" then true
+                  else ($v | nums) as $n | if ($n | length) < 4 then $n >= $m[0:($n | length)] else $n >= $m end
+                  end))')
+          if ! echo "$MATRIX" | jq -e --arg v "$MIN_VERSION" 'any(.[]; (.version // "") | endswith($v))' > /dev/null; then
+            echo "Adding the minimum supported version ${MIN_VERSION} to the matrix"
+            MATRIX=$(echo "$MATRIX" | jq -c --arg v "light-$MIN_VERSION" '. + [{version: $v, query: ""}]')
+          fi
+          # artifact names cannot contain "/", so give every entry a label.
+          # testRef is the lucee/lucee branch of the same line (6.2, 7.1, ...), so each core runs the test suite
+          # written for it; tests for core fixes on newer lines would otherwise fail on older cores.
+          MATRIX=$(echo "$MATRIX" | jq -c 'map(. + {label: ((.version // .query) | gsub("[^A-Za-z0-9._-]"; "-")), testRef: ((([.query, .version] | map(select(. != null and . != "")) | first // "") | capture("(?<l>[0-9]+\\.[0-9]+)").l) // "")})')
+          echo "Lucee test matrix: ${MATRIX}"
+          echo "MATRIX=${MATRIX}" >> "$GITHUB_OUTPUT"
 
       - name: Cache Lucee files
         uses: actions/cache@v4
@@ -37,20 +170,13 @@ jobs:
           path: ~/work/_actions/lucee/script-runner/main/lucee-download-cache
           key: lucee-downloads
 
-      - name: Import GPG key
-        run: |
-          echo "$GPG_PRIVATE_KEY" | base64 --decode | gpg --batch --import
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-
   build-and-test:
     runs-on: ubuntu-latest
     needs: setup
-    env:
-      LUCEE_TEST_VERSIONS_PLUS: ${{ vars.LUCEE_TEST_VERSIONS_PLUS }}
     strategy:
+      fail-fast: false
       matrix:
-        lucee: ${{ fromJSON(vars.LUCEE_TEST_VERSIONS_PLUS) }}
+        lucee: ${{ fromJSON(needs.setup.outputs.lucee_matrix) }}
     steps:
       - uses: actions/checkout@v4
 
@@ -60,22 +186,65 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
 
+      - name: Cache Maven packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2
+          key: ${{ runner.os }}-maven-v2-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-v2-
+
+      # A release run builds the version with -SNAPSHOT removed, the same one deploy publishes.
+      - name: Set the version for this run
+        if: needs.setup.outputs.release == 'true'
+        env:
+          VERSION: ${{ needs.setup.outputs.version }}
+        run: |
+          set -euo pipefail
+          python3 - "$VERSION" <<'PY'
+          import pathlib, re, sys
+          new = sys.argv[1]
+          path = pathlib.Path("pom.xml")
+          text = path.read_text()
+          pattern = r"(<artifactId>argon2-extension</artifactId>\s*<version>)[^<]+(</version>)"
+          text2, n = re.subn(pattern, lambda m: m.group(1) + new + m.group(2), text, count=1)
+          if n != 1:
+              raise SystemExit(f"project version was not updated (matches={n})")
+          path.write_text(text2)
+          print(f"pom.xml version is now {new}")
+          PY
+
       - name: Build and Install with Maven
+        timeout-minutes: 15
         run: |
           echo "------- Maven Install -------";
-          mvn -B -e -f pom.xml clean install
+          mvn -B -e -f pom.xml clean install -Dgoal=install
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: argon2-lex-${{ matrix.lucee.version }}
-          path: target/*.lex
+          name: argon2-lex-${{ matrix.lucee.label }}
+          path: |
+            target/*.lex
+            !target/*.lite.lex
 
       - name: Checkout Lucee
         uses: actions/checkout@v4
         with:
           repository: lucee/lucee
           path: lucee
+          ref: ${{ matrix.lucee.testRef }}
+
+      - name: Prepare extension dir for tests
+        run: rm -f target/*.lite.lex
+
+      - name: Log Lucee test matrix version
+        run: |
+          echo "Matrix lucee.version: ${{ matrix.lucee.version }}"
+          echo "Matrix lucee.query: ${{ matrix.lucee.query }}"
+          if [ -n "${{ matrix.lucee.query }}" ]; then
+            echo "Note: script-runner uses luceeVersionQuery when set; it overrides luceeVersion."
+          fi
 
       - name: Run Lucee Test Suite
         uses: lucee/script-runner@main
@@ -91,8 +260,9 @@ jobs:
 
   deploy:
     runs-on: ubuntu-latest
-    needs: [build-and-test]
-    if: always() && needs.build-and-test.result == 'success'
+    needs: [setup, build-and-test]
+    # pull requests (often from forks) get no secrets, so they only build and test
+    if: always() && needs.build-and-test.result == 'success' && needs.setup.outputs.publish == 'true'
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -107,9 +277,9 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.m2
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          key: ${{ runner.os }}-maven-v2-${{ hashFiles('**/pom.xml') }}
           restore-keys: |
-            ${{ runner.os }}-maven-
+            ${{ runner.os }}-maven-v2-
 
       - name: Import GPG key
         run: |
@@ -117,16 +287,210 @@ jobs:
         env:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
 
+      - name: Install Maven 3.9.16
+        # ubuntu-latest moved to Maven 3.10.0 (Oct 2026), which stages maven-metadata-local.xml
+        # in org/lucee/argon2-extension/; Central then rejects the bundle
+        # ("Bundle has content that does NOT have a .pom file"). Pin 3.9.16 for the deploy.
+        run: |
+          curl -fsSL -o /tmp/maven.tar.gz https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.tar.gz
+          echo "831a8591fe20c8243b1dbe7d71e3244f31d1665b0804b2e825e38cbbe5ce0cafb8338851f90780735568773e0a6cd07bbec107cda0b896b008b861075358b6f6  /tmp/maven.tar.gz" | sha512sum -c -
+          tar -xzf /tmp/maven.tar.gz -C /tmp
+          echo "/tmp/apache-maven-3.9.16/bin" >> "$GITHUB_PATH"
+          /tmp/apache-maven-3.9.16/bin/mvn -v
+
+      - name: Set the version for this run
+        if: needs.setup.outputs.release == 'true'
+        env:
+          VERSION: ${{ needs.setup.outputs.version }}
+        run: |
+          set -euo pipefail
+          python3 - "$VERSION" <<'PY'
+          import pathlib, re, sys
+          new = sys.argv[1]
+          path = pathlib.Path("pom.xml")
+          text = path.read_text()
+          pattern = r"(<artifactId>argon2-extension</artifactId>\s*<version>)[^<]+(</version>)"
+          text2, n = re.subn(pattern, lambda m: m.group(1) + new + m.group(2), text, count=1)
+          if n != 1:
+              raise SystemExit(f"project version was not updated (matches={n})")
+          path.write_text(text2)
+          print(f"pom.xml version is now {new}")
+          PY
+
       - name: Build and Deploy with Maven
         env:
           MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          VERSION: ${{ needs.setup.outputs.version }}
         run: |
-          if [[ "${{ needs.setup.outputs.version }}" == *-SNAPSHOT ]]; then
-            echo "------- Maven Deploy snapshot on ${{ github.event_name }} -------";
-            mvn -B -e -f pom.xml clean deploy --settings maven-settings.xml
+          set -euo pipefail
+          if [[ "$VERSION" == *-SNAPSHOT ]]; then
+            echo "------- Maven Deploy snapshot ${VERSION} on ${{ github.event_name }} -------";
+            mvn -B -e -f pom.xml clean deploy -Dgoal=deploy --settings maven-settings.xml
+          elif [[ "$VERSION" =~ -(RC|BETA|ALPHA)$ ]]; then
+            # pre-releases are not published to Maven Central, only to S3 (s3 job below)
+            echo "------- Maven Install (signed) ${VERSION} on ${{ github.event_name }}, S3 only -------";
+            mvn -B -e -f pom.xml clean install -Dgoal=install -DperformRelease=true --settings maven-settings.xml
+          else
+            echo "------- Maven Deploy release ${VERSION} on ${{ github.event_name }} -------";
+            mvn -B -e -f pom.xml clean deploy -Dgoal=deploy -DperformRelease=true --settings maven-settings.xml
+          fi
+
+      # everything the S3 upload needs (LDEV-6568): full and lite .lex plus the flattened POM
+      - name: Upload artifact for S3
+        if: success()
+        uses: actions/upload-artifact@v4
+        with:
+          name: argon2-s3
+          include-hidden-files: true
+          path: |
+            target/*.lex
+            .flattened-pom.xml
+
+  # LDEV-6688: publish every final, ALPHA, BETA and RC build as a GitHub release with its .lex files attached,
+  # so ext.lucee.org can redirect downloads to GitHub releases (LDEV-6511). -SNAPSHOT builds get no GitHub release.
+  # Separate job, so a failure here never blocks the Maven Central or S3 upload.
+  github-release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: [setup, deploy]
+    if: >-
+      always() && needs.deploy.result == 'success'
+      && needs.setup.outputs.publish == 'true'
+      && !endsWith(needs.setup.outputs.version, '-SNAPSHOT')
+    permissions:
+      # create the release (and its tag) and upload its assets
+      contents: write
+    steps:
+      # the same files the S3 job uploads (built by the deploy job with the published version)
+      - name: Download published extension
+        uses: actions/download-artifact@v4
+        with:
+          name: argon2-s3
+          path: release-files
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          VERSION: ${{ needs.setup.outputs.version }}
+          IS_DEFAULT_BRANCH: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          mapfile -t FILES < <(find release-files -type f \( -name "*-${VERSION}.lex" -o -name "*-${VERSION}.lite.lex" \) | sort)
+          if [ "${#FILES[@]}" -eq 0 ]; then
+            echo "::error::no .lex files for $VERSION found"; find release-files -type f; exit 1
+          fi
+          printf 'Asset: %s\n' "${FILES[@]}"
+
+          # the release tag is the exact published version (2.1.0.8 or 2.1.0.8-RC), created on this commit
+          # if it does not exist yet. ALPHA/BETA/RC are pre-releases and never "latest".
+          if [[ "$VERSION" == *-* ]]; then
+            PRE=(--prerelease --latest=false)
+          elif [ "$IS_DEFAULT_BRANCH" == "true" ]; then
+            PRE=(--latest)
           else
-            echo "------- Maven Deploy release on ${{ github.event_name }} -------";
-            mvn -B -e -f pom.xml clean deploy -DperformRelease=true --settings maven-settings.xml
+            PRE=(--latest=false)
+          fi
+
+          if gh release view "$VERSION" >/dev/null 2>&1; then
+            echo "Release $VERSION already exists - uploading assets again"
+            gh release upload "$VERSION" "${FILES[@]}" --clobber
+          else
+            echo "Creating release $VERSION ${PRE[*]} on $GITHUB_SHA"
+            gh release create "$VERSION" "${FILES[@]}" "${PRE[@]}" --target "$GITHUB_SHA" \
+              --title "$VERSION" \
+              --notes "Build $VERSION from commit $GITHUB_SHA, published by $RUN_URL"
+          fi
+
+  # upload the published build to the Maven folders, LDEV-6568.
+  # Cut-off rules (SNAPSHOTs stop on 2027-03-01) live in the called workflow.
+  # Finals and SNAPSHOTs are also on Central / the snapshot repo; RC, BETA and ALPHA are only here.
+  # secrets: inherit passes the org secrets S3_ACCESS_ID_DOWNLOAD and S3_SECRET_KEY_DOWNLOAD.
+  # The called workflow warns and skips when those secrets are not available to this repo.
+  s3:
+    needs: [setup, deploy]
+    if: always() && needs.deploy.result == 'success' && needs.setup.outputs.publish == 'true'
+    uses: lucee/lucee/.github/workflows/extension-s3-upload.yml@7.1
+    with:
+      artifact-name: argon2-s3
+      version: ${{ needs.setup.outputs.version }}
+    secrets: inherit
+
+  # After a release deploy, or a SNAPSHOT deploy on a push, commit the next -SNAPSHOT.
+  # No loop: the push uses the workflow token, which does not start another workflow run,
+  # and runs started by github-actions[bot] or with the bump message are skipped anyway.
+  bump:
+    runs-on: ubuntu-latest
+    needs: [setup, deploy, s3]
+    if: >-
+      always() && needs.deploy.result == 'success'
+      && needs.setup.outputs.publish == 'true'
+      && (needs.s3.result == 'success' || needs.s3.result == 'skipped')
+      && (needs.setup.outputs.release == 'true'
+        || (github.event_name == 'push'
+          && startsWith(github.ref, 'refs/heads/')
+          && endsWith(needs.setup.outputs.version, '-SNAPSHOT')
+          && github.actor != 'github-actions[bot]'
+          && !startsWith(github.event.head_commit.message, 'Set version to ')
+          && !contains(github.event.head_commit.message, '[skip ci]')))
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+          fetch-depth: 0
+
+      - name: Bump to the next SNAPSHOT
+        env:
+          NEXT_VERSION: ${{ needs.setup.outputs.next_version }}
+          DEPLOYED_VERSION: ${{ needs.setup.outputs.version }}
+          IS_RELEASE: ${{ needs.setup.outputs.release }}
+        run: |
+          set -euo pipefail
+          if [[ "$IS_RELEASE" != "true" ]]; then
+            # push: bump from the version on the branch tip, only if nobody bumped it since this deploy
+            CURRENT=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout | tr -d '\r')
+            if [[ "$CURRENT" != "$DEPLOYED_VERSION" ]]; then
+              echo "Branch is at ${CURRENT}, deployed ${DEPLOYED_VERSION}; already bumped, nothing to do"
+              exit 0
+            fi
+            BASE="${CURRENT%-SNAPSHOT}"
+            if ! [[ "$BASE" =~ ^[0-9]+(\.[0-9]+){3}$ ]]; then
+              echo "::warning::[${CURRENT}] is not a 4-part SNAPSHOT version, not bumping"
+              exit 0
+            fi
+            NEXT_VERSION="${BASE%.*}.$((10#${BASE##*.} + 1))-SNAPSHOT"
+            echo "Push run: bump pom.xml from ${CURRENT} to ${NEXT_VERSION}"
+          fi
+          if [[ -z "$NEXT_VERSION" ]]; then
+            echo "::error::next version was not resolved"
+            exit 1
+          fi
+          python3 - "$NEXT_VERSION" <<'PY'
+          import pathlib, re, sys
+          new = sys.argv[1]
+          path = pathlib.Path("pom.xml")
+          text = path.read_text()
+          pattern = r"(<artifactId>argon2-extension</artifactId>\s*<version>)[^<]+(</version>)"
+          text2, n = re.subn(pattern, lambda m: m.group(1) + new + m.group(2), text, count=1)
+          if n != 1:
+              raise SystemExit(f"project version was not updated (matches={n})")
+          path.write_text(text2)
+          print(f"pom.xml version is now {new}")
+          PY
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add pom.xml
+          if git diff --cached --quiet; then
+            echo "pom.xml already at ${NEXT_VERSION}"
+            exit 0
           fi
+          git commit -m "Set version to ${NEXT_VERSION}"
+          git fetch origin "${GITHUB_REF_NAME}"
+          git rebase "origin/${GITHUB_REF_NAME}"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
diff --git a/.gitignore b/.gitignore
index ef59bb6..f795b1e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 /dist
+temp
 **/Test.java
 **/TestCase.java
 **/.DS_Store
@@ -10,3 +11,4 @@ target
 target/*
 *.lock
 *.DS_Store
+**/.flattened-pom.xml
diff --git a/build.xml b/build.xml
index ffac689..a4e17f3 100644
--- a/build.xml
+++ b/build.xml
@@ -1,58 +1,107 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project default="clean" basedir="." name="argon2-extension">
-	<description>
+  <description>
         Build Argon2 Extension
     </description>
-    <!-- set global properties for this build -->
-  
+  <!-- set global properties for this build -->
 
-  <property name="lib" location="source/java/libs"/>
-  <property name="src" location="source/java/src"/>
   <property name="srcImg" location="source/images"/>
   <property name="temp" location="temp"/>
-  <property name="build" location="build"/>
   <property name="dist"  location="target"/>
 
-  <property name="tld" location="source/tld"/>
   <property name="fld" location="source/fld"/>
 
-  <path id="classpath">
-    <fileset dir="${lib}">
-      <include name="**/*.jar" />
-    </fileset>
-  </path>
-
   <target name="init">
-    <!-- Create the time stamp -->
-    <tstamp/>
-    
     <delete dir="${temp}"/>
-    <delete dir="${dist}"/>
-
-    <!-- Create the build directory structure used by compile -->
     <mkdir dir="${temp}"/>
-    <mkdir dir="${build}"/>
     <mkdir dir="${dist}/"/>
+  </target>
 
-
+  <!-- build the org.lucee:argon2-functions jar with Maven (deployed to Maven Central on deploy) -->
+  <target name="maven-build" depends="init">
+
+    <condition property="is.deploy" value="true" else="false">
+      <equals arg1="${maven.goal}" arg2="deploy"/>
+    </condition>
+
+    <!-- Check if artifact already exists in Maven Central -->
+    <condition property="artifact.exists">
+      <and>
+        <equals arg1="${is.deploy}" arg2="true"/>
+        <http url="https://repo1.maven.org/maven2/${mvnGroupPath}/${mvnArtifactId}/${bundleversion}/${mvnArtifactId}-${bundleversion}.pom"/>
+      </and>
+    </condition>
+
+    <!-- Set effective goal based on whether artifact exists -->
+    <condition property="effective.goal" value="install" else="${maven.goal}">
+      <equals arg1="${artifact.exists}" arg2="true"/>
+    </condition>
+
+    <echo>goal:${maven.goal}</echo>
+    <echo>effective.goal:${effective.goal}</echo>
+    <echo>performRelease:${is.deploy}</echo>
+    <echo>groupId:${mvnGroupId}</echo>
+    <echo>artifactId:${mvnArtifactId}</echo>
+    <echo>bundleversion:${bundleversion}</echo>
+    <echo>luceeCoreVersion:${luceeCoreVersion}</echo>
+
+    <exec dir="source/java" executable="mvn" failonerror="true">
+      <arg value="clean"/>
+      <arg value="${effective.goal}"/>
+      <arg value="-B"/>
+      <arg value="-e"/>
+      <arg value="-Drevision=${bundleversion}"/>
+      <arg value="-Dlucee.version=${luceeCoreVersion}"/>
+      <arg value="-DperformRelease=${is.deploy}"/>
+      <arg value="--settings"/>
+      <arg value="maven-settings.xml"/>
+      <!-- credentials as system properties, read from the environment by the root pom.xml -->
+      <arg value="-Dmaven.username=${maven.username}"/>
+      <arg value="-Dmaven.password=${maven.password}"/>
+      <arg value="-Dgpg.passphrase=${gpg.passphrase}"/>
+    </exec>
+
+    <!-- copy the runtime dependencies (not the provided Lucee core) in repository layout -->
+    <exec dir="source/java" executable="mvn" failonerror="true">
+      <arg value="-B"/>
+      <arg value="-DoutputDirectory=${temp}/dependency"/>
+      <arg value="-Dmdep.copyPom=true"/>
+      <arg value="-Dmdep.useRepositoryLayout=true"/>
+      <arg value="-DexcludeScope=provided"/>
+      <arg value="-Drevision=${bundleversion}"/>
+      <arg value="-Dlucee.version=${luceeCoreVersion}"/>
+      <arg value="dependency:copy-dependencies"/>
+    </exec>
+
+    <!-- parent POMs are needed to resolve the dependency POMs offline -->
+    <exec executable="bash" failonerror="true">
+      <arg value="${basedir}/copy-parent-poms.sh"/>
+      <arg value="${temp}/dependency"/>
+    </exec>
   </target>
 
+  <target name="copy-dependencies" depends="maven-build">
+    <property name="mvnDir" location="${dist}/extension/maven/${mvnGroupPath}/${mvnArtifactId}/${bundleversion}"/>
+    <mkdir dir="${mvnDir}"/>
+
+    <!-- the jar built by Maven -->
+    <copy file="source/java/target/${mvnArtifactId}-${bundleversion}.jar" tofile="${mvnDir}/${mvnArtifactId}-${bundleversion}.jar" failonerror="true"/>
+    <!-- the flattened POM (resolved version, dependency list), the same one that is published -->
+    <copy file="source/java/.flattened-pom.xml" tofile="${mvnDir}/${mvnArtifactId}-${bundleversion}.pom" failonerror="true"/>
 
-  <target name="copy" depends="init" description="copy source file to temp" >
-    <!-- copy the source -->
-    <copy todir="${temp}">
-      <fileset dir="${src}">
-        <include name="**/*.java"/>
-        <exclude name="**/Test.java"/>
-        <exclude name="**/TestCase.java"/>
+    <!-- all runtime dependencies -->
+    <copy todir="${dist}/extension/maven">
+      <fileset dir="${temp}/dependency">
+        <include name="**/*.jar"/>
+        <include name="**/*.pom"/>
       </fileset>
     </copy>
+  </target>
 
-
+  <target name="createManifest" depends="copy-dependencies" description="create MANIFEST.MF file" >
     <tstamp>
-     <format property="NOW" pattern="yyyy-MM-dd HH:mm:ss" />
+      <format property="NOW" pattern="yyyy-MM-dd HH:mm:ss" />
     </tstamp>
-
     <echo file="${dist}/extension/META-INF/MANIFEST.MF">Manifest-Version: 1.0
 Built-Date: ${NOW}
 version: "${bundleversion}"
@@ -66,67 +115,12 @@ release-type: ${releaseType}
 start-bundles: false
 </echo>
   </target>
-  
-
-
-  <target name="compile" depends="copy"
-        description="compile the source " >
-    <!-- Compile ACF-Infinspan source -->
-    <javac srcdir="${temp}" source="1.8" target="1.8" destdir="${build}" debug="true" debuglevel="lines,vars,source">
-      <classpath refid="classpath" />
-    </javac>
-  </target>
 
-  <target name="dist" depends="compile"
-        description="generate the distribution" >
-    
- 
-    <!-- Put everything in ${build} into .jar file -->
-    <jar 
-    	jarfile="${dist}/extension/jars/${filename}-${bundleversion}.jar" basedir="${build}"  manifest="${src}/META-INF/MANIFEST.MF">
-      <manifest>
-        <attribute name="Built-Date" value="${NOW}"/>
-        <attribute name="Bundle-SymbolicName" value="${bundlename}"/>
-        <attribute name="Bundle-Version" value="${bundleversion}"/>
-
-      </manifest>
-    </jar>
+  <target name="dist" depends="createManifest" description="generate the distribution" >
 
     <!-- copy the flds necessary -->
-    <copy 
-      file="${fld}/function.fld" 
-      tofile="${dist}/extension/flds/argon2-functions.fld" />
-
-    <replaceregexp 
-      file="${dist}/extension/flds/argon2-functions.fld" 
-      match="\{bundle-name\}" 
-      replace="${bundlename}" 
-      byline="true"/>
-    <replaceregexp 
-      file="${dist}/extension/flds/argon2-functions.fld" 
-      match="\{bundle-version\}" 
-      replace="${bundleversion}" 
-      byline="true"/>
-
-
-    <!-- copy the jars necessary -->
-    <copy todir="${dist}/extension/jars">
-      <fileset dir="${lib}">
-        <include name="**/*.jar"/>
-        <exclude name="**/javax.*"/>
-        <exclude name="**/jsp-*"/>
-        <exclude name="**/lucee.jar"/>
-        <exclude name="**/org.apache.felix.framework-*"/>
-
-        <!-- we exclude this because this is part of the Lucee core and in worst case it is loaded on the fly -->
-        <exclude name="**/httpcomponents-*"/>
-        <exclude name="**/org.lucee.httpcomponents.*"/>
-        <!-- <exclude name="**/org.apache.commons.codec-*"/> -->
-        <exclude name="**/commons-codec-*"/>
-        <exclude name="**/log4j-*"/>
-        <exclude name="**/javax-mail-activation-*"/>
-      </fileset>
-    </copy>
+    <copy file="${fld}/function.fld" tofile="${dist}/extension/flds/argon2-functions.fld" />
+    <replaceregexp file="${dist}/extension/flds/argon2-functions.fld" match="\{maven\}" replace="${mvnGroupId}:${mvnArtifactId}:${bundleversion}" byline="true"/>
 
     <!-- copy the logo -->
     <copy todir="${dist}/extension/META-INF">
@@ -135,16 +129,21 @@ start-bundles: false
       </fileset>
     </copy>
 
-    <!-- Zip everything  -->
-     <zip destfile="${dist}/${filename}-${bundleversion}.lex">
-        <zipfileset dir="${dist}/extension"/>
+    <!-- Zip everything -->
+    <zip destfile="${dist}/${filename}-${bundleversion}.lex">
+      <zipfileset dir="${dist}/extension"/>
     </zip>
-		
+
+    <!-- Lite artifact: same but without bundled Maven dependencies -->
+    <zip destfile="${dist}/${filename}-${bundleversion}.lite.lex">
+      <zipfileset dir="${dist}/extension">
+        <exclude name="maven/**"/>
+      </zipfileset>
+    </zip>
+  </target>
+
+  <target name="clean" depends="dist" description="clean up" >
+    <delete dir="${temp}"/>
   </target>
-	<target name="clean"  depends="dist" description="clean up" >
-		<!-- Delete the ${build} and ${dist} directory trees -->
-		<delete dir="${build}"/>
-		<delete dir="${temp}"/>
-	</target>
 
-</project>
\ No newline at end of file
+</project>
diff --git a/copy-parent-poms.sh b/copy-parent-poms.sh
new file mode 100644
index 0000000..6ace280
--- /dev/null
+++ b/copy-parent-poms.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+DEPENDENCY_DIR="$1"
+M2_REPO="${HOME}/.m2/repository"
+COPIED_TRACKER="${DEPENDENCY_DIR}/.parent_poms_copied"
+
+echo "========================================"
+echo "Copying parent POMs from local Maven repository"
+echo "========================================"
+
+# Create tracker file
+mkdir -p "$DEPENDENCY_DIR"
+> "$COPIED_TRACKER"
+
+# Function to check if we've already copied this POM
+is_already_copied() {
+    grep -qx "$1" "$COPIED_TRACKER" 2>/dev/null
+}
+
+# Function to mark POM as copied
+mark_as_copied() {
+    echo "$1" >> "$COPIED_TRACKER"
+}
+
+# Function to recursively copy parent chain
+copy_parent_chain() {
+    pom_file="$1"
+    
+    # Check if POM exists
+    if [ ! -f "$pom_file" ]; then
+        return
+    fi
+    
+    # Extract parent info (handles multi-line XML)
+    parent_block=$(sed -n '/<parent>/,/<\/parent>/p' "$pom_file" | tr '\n' ' ')
+    
+    if [ -z "$parent_block" ]; then
+        return  # No parent, stop recursion
+    fi
+    
+    parent_group=$(echo "$parent_block" | sed -n 's/.*<groupId>\([^<]*\)<\/groupId>.*/\1/p' | head -1)
+    parent_artifact=$(echo "$parent_block" | sed -n 's/.*<artifactId>\([^<]*\)<\/artifactId>.*/\1/p' | head -1)
+    parent_version=$(echo "$parent_block" | sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' | head -1)
+    
+    # Validate we got all three values
+    if [ -z "$parent_group" ] || [ -z "$parent_artifact" ] || [ -z "$parent_version" ]; then
+        return
+    fi
+    
+    # Create unique key for this POM (safe for file storage)
+    pom_key="${parent_group}__${parent_artifact}__${parent_version}"
+    
+    # Skip if already copied
+    if is_already_copied "$pom_key"; then
+        return
+    fi
+    
+    # Convert group ID to path
+    parent_path=$(echo "$parent_group" | tr '.' '/')
+    
+    # Source location in local Maven repo
+    parent_pom="$M2_REPO/$parent_path/$parent_artifact/$parent_version/$parent_artifact-$parent_version.pom"
+    
+    # Target location in dependency directory
+    target_dir="$DEPENDENCY_DIR/$parent_path/$parent_artifact/$parent_version"
+    
+    if [ -f "$parent_pom" ]; then
+        mkdir -p "$target_dir"
+        cp "$parent_pom" "$target_dir/"
+        echo "✓ Copied: $parent_artifact:$parent_version"
+        
+        # Mark as copied
+        mark_as_copied "$pom_key"
+        
+        # Recursively copy this parent's parent
+        copy_parent_chain "$parent_pom"
+    else
+        echo "✗ NOT FOUND in local repo: $parent_artifact:$parent_version"
+        echo "  Expected at: $parent_pom"
+    fi
+}
+
+# Find all POM files and process each
+find "$DEPENDENCY_DIR" -name "*.pom" -type f | while read pom; do
+    copy_parent_chain "$pom"
+done
+
+# Clean up tracker file
+rm -f "$COPIED_TRACKER"
+
+echo "========================================"
+echo "Parent POM copy complete"
+echo "========================================"
diff --git a/pom.xml b/pom.xml
index 7f5ba33..3a05c18 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,7 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.lucee</groupId>
     <artifactId>argon2-extension</artifactId>
-    <version>1.0.0.11</version>
+    <version>1.1.0.0-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Argon2 Extension</name>
 
@@ -17,7 +17,11 @@
         <image>https://raw.githubusercontent.com/lucee/extension-argon2/master/source/images/logo.png</image>
         <buildDate>${maven.build.timestamp}</buildDate>
         <bundlename>org.lucee.argon2.extension</bundlename>
-        <luceeCoreVersion>5.0.0.157</luceeCoreVersion>
+        <mvnGroupId>org.lucee</mvnGroupId>
+        <mvnGroupPath>org/lucee</mvnGroupPath>
+        <mvnArtifactId>argon2-functions</mvnArtifactId>
+        <!-- tags, functions and resources are loaded via maven=, compiled tags support maven= since 7.1.0 (first final: 7.1.0.204) -->
+        <luceeCoreVersion>7.1.0.204</luceeCoreVersion>
         <releaseType>server</releaseType>
         <label>Argon2 Extension</label>
         <release.url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</release.url>
@@ -83,6 +87,7 @@
                                 <configuration>
                                     <files>
                                         <file>${project.build.directory}/${project.artifactId}-${project.version}.lex</file>
+                                        <file>${project.build.directory}/${project.artifactId}-${project.version}.lite.lex</file>
                                     </files>
                                 </configuration>
                             </execution>
@@ -156,8 +161,16 @@
                                     <property name="description" value="${project.description}"/>
                                     <property name="srcversion" value="${maven.compiler.source}"/>
                                     <property name="trgversion" value="${maven.compiler.target}"/>
-                                
-</ant>
+                                    <property name="maven.goal" value="${goal}"/>
+                                    <property name="mvnGroupId" value="${mvnGroupId}"/>
+                                    <property name="mvnGroupPath" value="${mvnGroupPath}"/>
+                                    <property name="mvnArtifactId" value="${mvnArtifactId}"/>
+                                    <property name="mvnVersion" value="${project.version}"/>
+
+                                    <property name="maven.username" value="${env.MAVEN_USERNAME}"/>
+                                    <property name="maven.password" value="${env.MAVEN_PASSWORD}"/>
+                                    <property name="gpg.passphrase" value="${env.GPG_PASSPHRASE}"/>
+                                </ant>
                                 <condition property="isSnapshot" value="true" else="false">
                                     <matches string="${project.version}" pattern=".*-SNAPSHOT"/>
                                 </condition>
@@ -170,6 +183,11 @@
                                 <echo message="Deploying to URL: ${deploy.url}" />
                             </target>
                             <exportAntProperties>true</exportAntProperties>
+                            <propertySets>
+                                <propertySet>
+                                    <propertyRef prefix="env."/>
+                                </propertySet>
+                            </propertySets>
                         </configuration>
                     </execution>
                 </executions>
@@ -193,6 +211,11 @@
                                     <file>${project.build.directory}/${project.artifactId}-${project.version}.lex</file>
                                     <type>lex</type>
                                 </artifact>
+                                <artifact>
+                                    <file>${project.build.directory}/${project.artifactId}-${project.version}.lite.lex</file>
+                                    <type>lex</type>
+                                    <classifier>lite</classifier>
+                                </artifact>
                             </artifacts>
                         </configuration>
                     </execution>
@@ -238,16 +261,17 @@
                 <version>3.0.0-M1</version>
                 <executions>
                     <execution>
-                        <id>default-deploy</id>
+                        <id>deploy-lite</id>
                         <phase>deploy</phase>
                         <goals>
                             <goal>deploy-file</goal>
                         </goals>
                         <configuration>
-                            <file>${project.build.directory}/${project.artifactId}-${project.version}.lex</file>
+                            <file>${project.build.directory}/${project.artifactId}-${project.version}.lite.lex</file>
                             <groupId>${project.groupId}</groupId>
                             <artifactId>${project.artifactId}</artifactId>
                             <version>${project.version}</version>
+                            <classifier>lite</classifier>
                             <repositoryId>ossrh</repositoryId>
                             <url>${deploy.url}</url>
                             <packaging>lex</packaging>
diff --git a/source/fld/function.fld b/source/fld/function.fld
index a9f99ad..c19eff5 100755
--- a/source/fld/function.fld
+++ b/source/fld/function.fld
@@ -14,7 +14,7 @@
 
     <function>
 		<name>GenerateArgon2Hash</name>
-		<class bundle-name="{bundle-name}" bundle-version="{bundle-version}">org.lucee.extension.argon2.GenerateArgon2Hash</class>
+		<class maven="{maven}">org.lucee.extension.argon2.GenerateArgon2Hash</class>
 		<introduced>5.3.8.18</introduced>
 		<description>Returns hash of input using Argon2.</description>
     	<argument>
@@ -59,7 +59,7 @@
     
     <function>
 		<name>Argon2CheckHash</name>
-		<class bundle-name="{bundle-name}" bundle-version="{bundle-version}">org.lucee.extension.argon2.Argon2CheckHash</class>
+		<class maven="{maven}">org.lucee.extension.argon2.Argon2CheckHash</class>
 		<introduced>5.3.8.43</introduced>
 		<description>Returns hash of input using Argon2.</description>
     	<argument>
diff --git a/source/java/.classpath b/source/java/.classpath
index 2e679f3..adeb0a3 100644
--- a/source/java/.classpath
+++ b/source/java/.classpath
@@ -6,11 +6,5 @@
 			<attribute name="module" value="true"/>
 		</attributes>
 	</classpathentry>
-	<classpathentry kind="lib" path="libs/com.sun.jna-5.8.0.jar"/>
-	<classpathentry kind="lib" path="libs/javax.servlet-api-3.1.0.jar"/>
-	<classpathentry kind="lib" path="libs/jsp-api-2.2.jar"/>
-	<classpathentry kind="lib" path="libs/lucee.jar"/>
-	<classpathentry kind="lib" path="libs/org.lucee.argon2-2.12.0.jar"/>
-	<classpathentry kind="lib" path="libs/org.lucee.argon2-jvm-nolibs-2.12.0.jar"/>
 	<classpathentry kind="output" path="bin"/>
 </classpath>
diff --git a/source/java/.gitignore b/source/java/.gitignore
index 5e56e04..c41ba8f 100644
--- a/source/java/.gitignore
+++ b/source/java/.gitignore
@@ -1 +1,3 @@
 /bin
+target
+.flattened-pom.xml
diff --git a/source/java/libs/com.sun.jna-5.8.0.jar b/source/java/libs/com.sun.jna-5.8.0.jar
deleted file mode 100644
index c3d534c..0000000
Binary files a/source/java/libs/com.sun.jna-5.8.0.jar and /dev/null differ
diff --git a/source/java/libs/javax.servlet-api-3.1.0.jar b/source/java/libs/javax.servlet-api-3.1.0.jar
deleted file mode 100644
index 6b14c3d..0000000
Binary files a/source/java/libs/javax.servlet-api-3.1.0.jar and /dev/null differ
diff --git a/source/java/libs/jsp-api-2.2.jar b/source/java/libs/jsp-api-2.2.jar
deleted file mode 100644
index 64e1b74..0000000
Binary files a/source/java/libs/jsp-api-2.2.jar and /dev/null differ
diff --git a/source/java/libs/lucee.jar b/source/java/libs/lucee.jar
deleted file mode 100644
index 0676b53..0000000
Binary files a/source/java/libs/lucee.jar and /dev/null differ
diff --git a/source/java/libs/org.lucee.argon2-2.12.0.jar b/source/java/libs/org.lucee.argon2-2.12.0.jar
deleted file mode 100644
index cd8ca7b..0000000
Binary files a/source/java/libs/org.lucee.argon2-2.12.0.jar and /dev/null differ
diff --git a/source/java/libs/org.lucee.argon2-jvm-nolibs-2.12.0.jar b/source/java/libs/org.lucee.argon2-jvm-nolibs-2.12.0.jar
deleted file mode 100644
index eafceb8..0000000
Binary files a/source/java/libs/org.lucee.argon2-jvm-nolibs-2.12.0.jar and /dev/null differ
diff --git a/source/java/maven-settings.xml b/source/java/maven-settings.xml
new file mode 100755
index 0000000..339881c
--- /dev/null
+++ b/source/java/maven-settings.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <pluginGroups></pluginGroups>
+  <proxies></proxies>
+  <servers>
+    <server>
+      <id>ossrh</id>
+      <username>${maven.username}</username>
+      <password>${maven.password}</password>
+    </server>
+  </servers>
+  <mirrors></mirrors>
+  <profiles>
+    <profile>
+      <id>ossrh</id>
+      <activation>
+        <activeByDefault>true</activeByDefault>
+      </activation>
+      <properties>
+        <gpg.executable>gpg2</gpg.executable>
+        <gpg.passphrase>${gpg.passphrase}</gpg.passphrase>
+      </properties>
+    </profile>
+  </profiles>
+</settings>
\ No newline at end of file
diff --git a/source/java/pom.xml b/source/java/pom.xml
new file mode 100644
index 0000000..f53feb6
--- /dev/null
+++ b/source/java/pom.xml
@@ -0,0 +1,204 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>org.lucee</groupId>
+  <artifactId>argon2-functions</artifactId>
+  <version>${revision}</version>
+
+  <name>Argon2 Functions</name>
+  <description>Implementation of the GenerateArgon2Hash and Argon2CheckHash functions on top of the upstream de.mkammerer:argon2-jvm</description>
+  <url>https://github.com/lucee/extension-argon2</url>
+
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <!-- compile against the minimum supported core, the ant build passes luceeCoreVersion from the root pom.xml -->
+    <lucee.version>7.1.0.204</lucee.version>
+  </properties>
+
+  <licenses>
+    <license>
+      <name>The GNU Lesser General Public License, Version 2.1</name>
+      <url>http://www.gnu.org/licenses/lgpl-2.1.txt</url>
+    </license>
+  </licenses>
+
+  <developers>
+    <developer>
+      <id>micstriit</id>
+      <name>Michael Offner</name>
+      <email>michael@lucee.org</email>
+      <organization>Lucee Association Switzerland</organization>
+      <organizationUrl>http://lucee.org</organizationUrl>
+      <roles>
+        <role>Project-Administrator</role>
+        <role>Developer</role>
+      </roles>
+      <timezone>+1</timezone>
+    </developer>
+  </developers>
+
+  <build>
+    <sourceDirectory>src</sourceDirectory>
+    <plugins>
+
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>flatten-maven-plugin</artifactId>
+        <version>1.6.0</version>
+        <configuration>
+          <updatePomFile>true</updatePomFile>
+          <flattenMode>oss</flattenMode>
+        </configuration>
+        <executions>
+          <execution>
+            <id>flatten</id>
+            <phase>process-resources</phase>
+            <goals>
+              <goal>flatten</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>flatten.clean</id>
+            <phase>clean</phase>
+            <goals>
+              <goal>clean</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-source-plugin</artifactId>
+        <version>3.3.0</version>
+        <executions>
+          <execution>
+            <id>attach-sources</id>
+            <goals>
+              <goal>jar-no-fork</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-javadoc-plugin</artifactId>
+        <version>3.6.3</version>
+        <executions>
+          <execution>
+            <id>attach-javadocs</id>
+            <goals>
+              <goal>jar</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <source>11</source>
+          <doclint>none</doclint>
+        </configuration>
+      </plugin>
+
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-release-plugin</artifactId>
+        <version>3.0.0</version>
+        <configuration>
+          <autoVersionSubmodules>true</autoVersionSubmodules>
+          <useReleaseProfile>false</useReleaseProfile>
+          <releaseProfiles>release</releaseProfiles>
+          <goals>deploy</goals>
+        </configuration>
+      </plugin>
+
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <version>3.11.0</version>
+        <configuration>
+          <source>11</source>
+          <target>11</target>
+        </configuration>
+      </plugin>
+
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-jar-plugin</artifactId>
+        <version>3.3.0</version>
+        <configuration>
+          <archive>
+            <manifest>
+              <addClasspath>true</addClasspath>
+            </manifest>
+          </archive>
+        </configuration>
+      </plugin>
+
+      <plugin>
+        <groupId>org.sonatype.central</groupId>
+        <artifactId>central-publishing-maven-plugin</artifactId>
+        <version>0.8.0</version>
+        <extensions>true</extensions>
+        <configuration>
+          <publishingServerId>ossrh</publishingServerId>
+          <autoPublish>true</autoPublish>
+        </configuration>
+      </plugin>
+
+    </plugins>
+  </build>
+
+  <dependencies>
+    <!-- the upstream artifact: brings the native libraries for all platforms,
+         argon2-jvm-nolibs (compile) and JNA (runtime) as transitive dependencies -->
+    <dependency>
+      <groupId>de.mkammerer</groupId>
+      <artifactId>argon2-jvm</artifactId>
+      <version>2.12</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.lucee</groupId>
+      <artifactId>lucee</artifactId>
+      <version>${lucee.version}</version>
+      <scope>provided</scope>
+    </dependency>
+  </dependencies>
+
+  <profiles>
+    <profile>
+      <id>release-sign-artifacts</id>
+      <activation>
+        <property>
+          <name>performRelease</name>
+          <value>true</value>
+        </property>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-gpg-plugin</artifactId>
+            <version>3.0.1</version>
+            <executions>
+              <execution>
+                <id>sign-artifacts</id>
+                <phase>verify</phase>
+                <goals>
+                  <goal>sign</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+
+  <scm>
+    <url>https://github.com/lucee/extension-argon2</url>
+    <connection>scm:git:git://github.com/lucee/extension-argon2.git</connection>
+    <developerConnection>scm:git:git@github.com:lucee/extension-argon2.git</developerConnection>
+    <tag>${project.version}</tag>
+  </scm>
+
+</project>
diff --git a/source/java/src/META-INF/MANIFEST.MF b/source/java/src/META-INF/MANIFEST.MF
deleted file mode 100644
index 790fa4b..0000000
--- a/source/java/src/META-INF/MANIFEST.MF
+++ /dev/null
@@ -1,5 +0,0 @@
-Manifest-Version: 1.0
-Export-Package: org.lucee.extension.argon2
-Bundle-ManifestVersion: 2
-Require-Bundle: org.lucee.argon2;bundle-version=2.12.0,
- org.lucee.argon2-jvm-nolibs;bundle-version=2.12.0