diff --git a/.github/workflows/cd-test.yml b/.github/workflows/cd-test.yml
new file mode 100644
index 0000000..d8d87c3
--- /dev/null
+++ b/.github/workflows/cd-test.yml
@@ -0,0 +1,15 @@
+name: Continuous delivery - test
+
+on:
+  pull_request:
+    # opened, reopenened, synchronize are the default types for pull_request
+    # labeled, unlabeled ensure this check is also run if a label is added or removed
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+
+jobs:
+  test-publish:
+    runs-on: ubuntu-latest
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-publish-check') }}
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - run: cargo publish --dry-run
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
new file mode 100644
index 0000000..65ef742
--- /dev/null
+++ b/.github/workflows/cd.yml
@@ -0,0 +1,20 @@
+name: Continuous delivery - crates.io
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: crates.io
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+    - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18  # v1.0.5
+      id: auth
+    - run: cargo publish
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ff5e5e..4b14a29 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,16 @@
 
 ## [Unreleased][]
 
-[Unreleased]: https://github.com/trussed-dev/piv-authenticator/compare/v0.6.0...HEAD
+[Unreleased]: https://github.com/trussed-dev/piv-authenticator/compare/v0.7.0...HEAD
 
 -
 
+## [v0.7.0][] (2026-08-17)
+
+[v0.7.0]: https://github.com/trussed-dev/piv-authenticator/releases/tag/v0.7.0
+
+- Move the test setup into a local dependency, use released dependencies and prepare a release to crates.io.
+
 ## [v0.6.0][] (2026-03-25)
 
 [v0.6.0]: https://github.com/trussed-dev/piv-authenticator/releases/tag/v0.6.0
diff --git a/Cargo.toml b/Cargo.toml
index 61e6d7c..a62548b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@ members = ["dev-vpicc"]
 
 [package]
 name = "piv-authenticator"
-version = "0.6.0"
+version = "0.7.0"
 authors = ["Nicolas Stalder <n@stalder.io>", "Nitrokey GmbH"]
 edition = "2021"
 license = "Apache-2.0 OR MIT"
@@ -73,12 +73,6 @@ log-info = []
 log-warn = []
 log-error = []
 
-[patch.crates-io]
-trussed = { git = "https://github.com/trussed-dev/trussed", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
-trussed-auth-backend = { git = "https://github.com/trussed-dev/trussed-auth", tag = "backend-v0.1.0" }
-trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", tag = "v0.4.0" }
-trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.4.0" }
-
 [profile.dev.package.rsa]
 opt-level = 2
 
diff --git a/dev-vpicc/Cargo.toml b/dev-vpicc/Cargo.toml
index 24c0d25..5f87e87 100644
--- a/dev-vpicc/Cargo.toml
+++ b/dev-vpicc/Cargo.toml
@@ -9,10 +9,11 @@ heapless = "0.9"
 vpicc = "0.1.0"
 piv-authenticator = { path = ".." }
 log = "0.4"
-trussed-rsa-alloc = { version = "0.4", features = ["raw"] }
-trussed = { version = "0.1", default-features = false, features = ["aes256-cbc", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "p256", "p384", "shared-secret", "serde-extensions", "tdes", "x255", "virt"]  }
-trussed-auth-backend = "0.1.0"
-trussed-staging = { version = "0.4", features = ["chunked", "hpke", "wrap-key-to-file"], default-features = false }
+trussed-rsa-alloc = { version = "0.5", features = ["raw"] }
+trussed = { version = "0.2", default-features = false, features = ["aes256-cbc", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "p256", "p384", "shared-secret", "serde-extensions", "tdes", "x255", "virt"]  }
+trussed-auth-backend = "0.2"
+trussed-core = "0.2"
+trussed-staging = { version = "0.5", features = ["chunked", "hpke", "wrap-key-to-file"], default-features = false }
 trussed-wrap-key-to-file = "0.3.0"
 trussed-hpke = "0.3.0"
 trussed-chunked = "0.3.0"
diff --git a/dev-vpicc/src/virt.rs b/dev-vpicc/src/virt.rs
index 8f74db0..759c078 100644
--- a/dev-vpicc/src/virt.rs
+++ b/dev-vpicc/src/virt.rs
@@ -3,17 +3,20 @@
 pub mod dispatch {
 
     use trussed::{
-        api::{Reply, Request, reply, request},
         backend::{Backend as _, BackendId},
-        error::Error,
         platform::Platform,
         serde_extensions::{ExtensionDispatch, ExtensionId, ExtensionImpl},
         service::ServiceResources,
-        types::{Bytes, Context, Location},
+        types::Context,
     };
     use trussed_auth::AuthExtension;
     use trussed_auth_backend::{AuthBackend, AuthContext, FilesystemLayout, MAX_HW_KEY_LEN};
     use trussed_chunked::ChunkedExtension;
+    use trussed_core::{
+        Error,
+        api::{Reply, Request, reply, request},
+        types::{Bytes, Location},
+    };
     use trussed_hpke::HpkeExtension;
     use trussed_rsa_alloc::SoftwareRsa;
     use trussed_staging::{StagingBackend, StagingContext};
@@ -206,10 +209,8 @@ pub mod dispatch {
 }
 
 use std::path::PathBuf;
-use trussed::{
-    types::Bytes,
-    virt::{self, Client, StorageConfig, StoreConfig},
-};
+use trussed::virt::{self, Client, StorageConfig, StoreConfig};
+use trussed_core::types::Bytes;
 
 /// Client type using a dispatcher with the backends required by opcard
 pub type VirtClient<'a> = Client<'a, dispatch::Dispatch>;