diff --git a/.copier-answers.yml b/.copier-answers.yml
index facfe1e9..c26f5c43 100644
--- a/.copier-answers.yml
+++ b/.copier-answers.yml
@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: v0.0.60
+_commit: v0.0.61
 _src_path: gh:LabAutomationAndScreening/copier-base-template.git
 description: Copier template for creating Python libraries and executables
 python_ci_versions:
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index e0fdfc53..8198618c 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -61,5 +61,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 2b781a57 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 9e371a58 # spellchecker:disable-line
 }
diff --git a/.devcontainer/install-ci-tooling.py b/.devcontainer/install-ci-tooling.py
index fc427100..372fed2c 100644
--- a/.devcontainer/install-ci-tooling.py
+++ b/.devcontainer/install-ci-tooling.py
@@ -7,7 +7,7 @@
 import tempfile
 from pathlib import Path
 
-UV_VERSION = "0.8.3"
+UV_VERSION = "0.8.4"
 PNPM_VERSION = "10.14.0"
 COPIER_VERSION = "9.8.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "0.3.2"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index fb8280d8..07169ccf 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,17 +11,20 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    id-token: write
-    contents: write # needed for mutex, and updating dependabot branches
-    statuses: write # needed for updating status on Dependabot PRs
+  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   get-values:
     uses: ./.github/workflows/get-values.yaml
+    permissions:
+      contents: write # needed for updating dependabot branches
 
   pre-commit:
     needs: [ get-values ]
     uses: ./.github/workflows/pre-commit.yaml
+    permissions:
+      contents: write # needed for mutex
+      id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
     with:
       python-version: 3.12.7
 
@@ -43,6 +46,10 @@ jobs:
           '--data-file tests/copier_data/data3.yaml',
           ]
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+    permissions:
+      contents: write # needed for mutex
 
     steps:
       - name: Checkout code
@@ -125,6 +132,8 @@ jobs:
   required-check:
     runs-on: ubuntu-24.04
     needs: [ lint-matrix, get-values ]
+    permissions:
+      statuses: write # needed for updating status on Dependabot PRs
     if: always()
     steps:
       - name: fail if prior job failure
diff --git a/.github/workflows/get-values.yaml b/.github/workflows/get-values.yaml
index 1043f947..a9f5c333 100644
--- a/.github/workflows/get-values.yaml
+++ b/.github/workflows/get-values.yaml
@@ -14,7 +14,7 @@ env:
   PYTHONUNBUFFERED: True
 
 permissions:
-    contents: write # needed to push commit of new devcontainer hash for dependabot PRs
+  contents: write # needed to push commit of new devcontainer hash for dependabot PRs
 
 jobs:
   get-values:
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index ecb2cd0d..24534af2 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -22,7 +22,8 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    contents: write # needed for mutex
+  contents: write # needed for mutex
+  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   pre-commit:
diff --git a/.gitignore b/.gitignore
index 39948f95..f7300be2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,6 +48,7 @@ coverage-report-pytest
 .mypy_cache/
 .coverage
 .coverage.*
+coverage.xml
 
 # test profiling
 prof/
diff --git a/extensions/context.py b/extensions/context.py
index 6aa117f9..7d3405ec 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -10,7 +10,7 @@ class ContextUpdater(ContextHook):
 
     @override
     def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
-        context["uv_version"] = "0.8.3"
+        context["uv_version"] = "0.8.4"
         context["pnpm_version"] = "10.14.0"
         context["pre_commit_version"] = "4.2.0"
         context["pyright_version"] = "1.1.403"
diff --git a/template/.github/workflows/ci.yaml.jinja b/template/.github/workflows/ci.yaml.jinja
index dda6ae65..a99e9ae5 100644
--- a/template/.github/workflows/ci.yaml.jinja
+++ b/template/.github/workflows/ci.yaml.jinja
@@ -11,18 +11,21 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    id-token: write
-    contents: write # needed for mutex, and updating dependabot branches
-    statuses: write # needed for updating status on Dependabot PRs
+  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   get-values:
     uses: ./.github/workflows/get-values.yaml
+    permissions:
+      contents: write # needed updating dependabot branches
 
   lint:
     needs: [ get-values ]
     name: Pre-commit
     uses: ./.github/workflows/pre-commit.yaml
+    permissions:
+      contents: write # needed for mutex
+      id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
     with:
       python-version: {% endraw %}{{ python_version }}{% raw %}
 
@@ -43,7 +46,8 @@ jobs:
             JOB_MATCHING_DEV_ENV: true
 
     runs-on: ${{ matrix.os }}
-
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
     steps:
       - name: Checkout code
         uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
@@ -84,6 +88,8 @@ jobs:
           - {{ item }}
 {% endfor %}{% raw %}
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
@@ -117,6 +123,8 @@ jobs:
 {% endfor %}{% raw %}
 
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
@@ -137,6 +145,8 @@ jobs:
 
   required-check:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    permissions:
+      statuses: write # needed for updating status on Dependabot PRs
     needs:
       - test
       - get-values{% endraw %}{% if create_docs %}
diff --git a/template/.github/workflows/get-values.yaml b/template/.github/workflows/get-values.yaml
index 1043f947..a9f5c333 100644
--- a/template/.github/workflows/get-values.yaml
+++ b/template/.github/workflows/get-values.yaml
@@ -14,7 +14,7 @@ env:
   PYTHONUNBUFFERED: True
 
 permissions:
-    contents: write # needed to push commit of new devcontainer hash for dependabot PRs
+  contents: write # needed to push commit of new devcontainer hash for dependabot PRs
 
 jobs:
   get-values:
diff --git a/template/.github/workflows/pre-commit.yaml b/template/.github/workflows/pre-commit.yaml
index ecb2cd0d..24534af2 100644
--- a/template/.github/workflows/pre-commit.yaml
+++ b/template/.github/workflows/pre-commit.yaml
@@ -22,7 +22,8 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    contents: write # needed for mutex
+  contents: write # needed for mutex
+  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   pre-commit:
diff --git a/template/.github/workflows/publish.yaml.jinja b/template/.github/workflows/publish.yaml.jinja
index 1701cd2d..bf1691ad 100644
--- a/template/.github/workflows/publish.yaml.jinja
+++ b/template/.github/workflows/publish.yaml.jinja
@@ -13,8 +13,7 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    id-token: write
-    contents: write # needed for mutex
+  id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   get-values:
@@ -39,6 +38,9 @@ jobs:
   lint:
     name: Pre-commit
     uses: ./.github/workflows/pre-commit.yaml
+    permissions:
+      contents: write # needed for mutex
+      id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
     with:
       python-version: {% endraw %}{{ python_version }}{% raw %}
 
@@ -59,6 +61,8 @@ jobs:
             JOB_MATCHING_DEV_ENV: true
 
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
@@ -167,6 +171,8 @@ jobs:
             JOB_MATCHING_DEV_ENV: true
 
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
@@ -258,6 +264,8 @@ jobs:
             JOB_MATCHING_DEV_ENV: true
 
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
diff --git a/template/.github/workflows/publish_to_staging.yaml.jinja b/template/.github/workflows/publish_to_staging.yaml.jinja
index a2ac7df8..a6ee92bb 100644
--- a/template/.github/workflows/publish_to_staging.yaml.jinja
+++ b/template/.github/workflows/publish_to_staging.yaml.jinja
@@ -8,13 +8,15 @@ env:
   PRE_COMMIT_HOME: ${{ github.workspace }}/.precommit_cache
 
 permissions:
-    id-token: write
-    contents: write # needed for mutex
+    id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
 
 jobs:
   lint:
     name: Pre-commit
     uses: ./.github/workflows/pre-commit.yaml
+    permissions:
+      contents: write # needed for mutex
+      id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
     with:
       python-version: {% endraw %}{{ python_version }}{% raw %}
 
@@ -35,6 +37,8 @@ jobs:
             JOB_MATCHING_DEV_ENV: true
 
     runs-on: ${{ matrix.os }}
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
 
     steps:
       - name: Checkout code
diff --git a/template/.gitignore b/template/.gitignore
index 39948f95..f7300be2 100644
--- a/template/.gitignore
+++ b/template/.gitignore
@@ -48,6 +48,7 @@ coverage-report-pytest
 .mypy_cache/
 .coverage
 .coverage.*
+coverage.xml
 
 # test profiling
 prof/