diff --git a/.github/workflows/build_and_release.yml b/.github/workflows/build_and_release.yml
index 37229a02..6e41744e 100644
--- a/.github/workflows/build_and_release.yml
+++ b/.github/workflows/build_and_release.yml
@@ -9,18 +9,19 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
 
-    - name: Set Up JDK
-      uses: actions/setup-java@v1
+    - name: Set up JDK 17
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
       with:
-        java-version: 8
+        distribution: temurin
+        java-version: 17
 
     - name: Build release .aar
       run: ./gradlew assembleRelease
 
     - name: Archive J2V8 Android aar
-      uses: actions/upload-artifact@v1.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: j2v8-android-aar
         path: build/outputs/aar/j2v8-release.aar
diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 494929f0..1b3319ca 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -3,52 +3,28 @@ name: Build and test J2V8
 on: [push]
 
 jobs:
-  build_j2v8_linux_x86_64:
-    name: Build J2V8 for Linux
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout
-      uses: actions/checkout@v1
-
-    - name: Download monolithic libraries and extract to v8.out
-      run: |
-        curl -k -O http://download.eclipsesource.com/j2v8/v8/libv8_9.3.345.11_monolith.zip
-        mkdir -p v8.out
-        unzip libv8_9.3.345.11_monolith.zip -d v8.out
-
-    - name: Start J2V8 build
-      run: python2 build.py -t linux -a x64 --docker j2v8cmake j2v8jni j2v8cpp j2v8optimize j2v8java j2v8test
-
-    - name: Archive J2V8 Linux x86_64 jar
-      uses: actions/upload-artifact@v1.0.0
-      with:
-        name: j2v8-linux-x86_64
-        path: build.out/j2v8_linux_x86_64-6.2.1.jar
-
   build_j2v8_android:
     name: Build J2V8 for Android
     runs-on: ubuntu-latest
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+
+    - name: Set up JDK 17
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
+      with:
+        distribution: temurin
+        java-version: 17
 
-    - name: Download monolithic libraries and extract to v8.out
-      run: |
-        curl -k -O http://download.eclipsesource.com/j2v8/v8/libv8_9.3.345.11_monolith.zip
-        mkdir -p v8.out
-        unzip libv8_9.3.345.11_monolith.zip -d v8.out
+    - name: Point ANDROID_NDK_HOME at the runner's NDK
+      run: echo "ANDROID_NDK_HOME=${ANDROID_NDK_HOME:-$ANDROID_NDK_LATEST_HOME}" >> "$GITHUB_ENV"
 
-    - name: Start J2V8 build
-      run: |
-        python2 build.py -t android -a x86 --docker --keep-native-libs j2v8cmake j2v8jni j2v8cpp j2v8optimize j2v8java
-        python2 build.py -t android -a arm --docker --keep-native-libs j2v8cmake j2v8jni j2v8cpp j2v8optimize j2v8java
-        python2 build.py -t android -a x86_64 --docker --keep-native-libs j2v8cmake j2v8jni j2v8cpp j2v8optimize j2v8java
-        python2 build.py -t android -a arm64 --docker --keep-native-libs j2v8cmake j2v8jni j2v8cpp j2v8optimize j2v8java
+    - name: Build native libraries and release .aar
+      run: ./rebuild_native.sh
 
     - name: Archive J2V8 Android aar
-      uses: actions/upload-artifact@v1.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: j2v8-android-aar
         path: build/outputs/aar/j2v8-release.aar
diff --git a/.github/workflows/socket-basics.yml b/.github/workflows/socket-basics.yml
new file mode 100644
index 00000000..a19fb451
--- /dev/null
+++ b/.github/workflows/socket-basics.yml
@@ -0,0 +1,15 @@
+name: Socket Basics Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  socket-basics-security-scan:
+    # We intentionally run this shared action from @main, not from a pinned sha
+    # this is because we control the shared-actions repo, so there is not a significant risk of malicious changes being pushed.
+    # Plus, the shared action does use pinned dependencies, and so will be updated fairly often.  When we do that, we do not
+    # want to have to update the sha in every repo that uses this shared action, before such updates apply.
+    uses: ynab/shared-actions/.github/workflows/socket-basics.yml@main
+    secrets:
+      SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
diff --git a/.gitignore b/.gitignore
index 4691f9b0..0dac98a5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,5 @@ test-mockup-os-release
 *.tar.*
 
 local.properties
+.socket-scans/
+.socket.facts.json