diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index b06b7527..4624b164 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -13,9 +13,14 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: autofix-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
   autofix:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/ci-dataset.yml b/.github/workflows/ci-dataset.yml
index 19f11e52..4540901c 100644
--- a/.github/workflows/ci-dataset.yml
+++ b/.github/workflows/ci-dataset.yml
@@ -20,11 +20,14 @@ permissions: {}
 jobs:
   schema:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install check-jsonschema
         run: pipx install check-jsonschema
@@ -53,16 +56,22 @@ jobs:
             check-jsonschema --schemafile docs/schemas/profiles.schema.json "${files[@]}"
           fi
 
+      - name: Summary
+        run: echo "### ✅ Schema validation - positions, stations & profiles" >> $GITHUB_STEP_SUMMARY
+
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        run: rustup toolchain install stable --profile minimal --no-self-update
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
@@ -72,3 +81,6 @@ jobs:
 
       - name: Validate dataset
         run: cargo run --quiet --release --locked --bin vacs-data --manifest-path tools/Cargo.toml -- --log-format github validate dataset/
+
+      - name: Summary
+        run: echo "### ✅ Dataset validation - all files valid" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 5a7b5438..17c27ef8 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -34,7 +34,9 @@ defaults:
 jobs:
   cargo-deny:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
+      fail-fast: false
       matrix:
         checks:
           - advisories
@@ -55,8 +57,12 @@ jobs:
           command: check ${{ matrix.checks }}
           command-arguments: "--config tools/deny.toml"
 
+      - name: Summary
+        run: echo "### ✅ Cargo Deny - ${{ matrix.checks }}" >> $GITHUB_STEP_SUMMARY
+
   cargo-machete:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     continue-on-error: true
     steps:
       - name: Checkout
@@ -65,32 +71,97 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Install cargo-machete
+        run: cargo install cargo-machete --locked
+
       - name: cargo machete
-        uses: bnjbvr/cargo-machete@7959c845782fed02ee69303126d4a12d64f1db18 # v0.9.1
+        run: cargo machete
+
+      - name: Summary
+        run: echo "### ✅ Cargo Machete - no unused dependencies" >> $GITHUB_STEP_SUMMARY
+
+  fmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Rust toolchain
+        run: rustup toolchain install stable --profile minimal --no-self-update --component rustfmt
+
+      - name: Format
+        run: cargo fmt --all -- --check
+
+      - name: Summary
+        run: echo "### ✅ Rustfmt - all files formatted" >> $GITHUB_STEP_SUMMARY
 
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
+        run: rustup toolchain install stable --profile minimal --no-self-update
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+
+      - name: Tests
+        run: cargo test --locked --workspace --all-targets --all-features
+
+      - name: Summary
+        run: echo "### ✅ Tests - all workspace tests passed" >> $GITHUB_STEP_SUMMARY
+
+  clippy:
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: "ubuntu-22.04"
+            arch: "x86_64"
+            target: "x86_64-unknown-linux-gnu"
+          - platform: "windows-latest"
+            arch: "x86_64"
+            target: "x86_64-pc-windows-msvc"
+          - platform: "macos-latest"
+            arch: "aarch64"
+            target: "aarch64-apple-darwin" # for Arm based macs (M1 and above).
+
+    runs-on: ${{ matrix.platform }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          shared-key: "linux-x86_64"
-          workspaces: "tools -> target"
+          persist-credentials: false
 
-      - name: Format
-        run: cargo fmt --all -- --check
+      - name: Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update --component clippy
+          rustup target add ${{ matrix.target }}
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+        with:
+          shared-key: ${{ matrix.platform }}-${{ matrix.arch }}
 
       - name: Clippy
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+        run: cargo clippy --locked --workspace --all-targets --all-features --target ${{ matrix.target }} -- -D warnings
 
-      - name: Tests
-        run: cargo test --workspace --all-targets --all-features
+      - name: Summary
+        run: echo "### ✅ Clippy - ${{ matrix.platform }} (${{ matrix.arch }})" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/deploy-dataset.yml b/.github/workflows/deploy-dataset.yml
index 8ac5cecb..bcd5f1c2 100644
--- a/.github/workflows/deploy-dataset.yml
+++ b/.github/workflows/deploy-dataset.yml
@@ -30,6 +30,7 @@ jobs:
   deploy-dev:
     name: Deploy to dev
     needs: validate
+    timeout-minutes: 10
     if: >-
       (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/'))
       || (github.event_name == 'workflow_dispatch' && inputs.environment == 'dev')
@@ -46,6 +47,7 @@ jobs:
         with:
           sparse-checkout: .github/actions
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Deploy dataset
         uses: ./.github/actions/deploy-dataset
@@ -90,6 +92,7 @@ jobs:
   deploy-production:
     name: Deploy to production
     needs: validate
+    timeout-minutes: 10
     if: >-
       (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/airac-'))
       || (github.event_name == 'workflow_dispatch' && inputs.environment == 'production')
@@ -123,6 +126,7 @@ jobs:
         with:
           sparse-checkout: .github/actions
           sparse-checkout-cone-mode: false
+          persist-credentials: false
 
       - name: Deploy dataset
         uses: ./.github/actions/deploy-dataset
diff --git a/.github/workflows/release-tools.yml b/.github/workflows/release-tools.yml
index 1e6843da..ac22c3a0 100644
--- a/.github/workflows/release-tools.yml
+++ b/.github/workflows/release-tools.yml
@@ -26,6 +26,7 @@ defaults:
 jobs:
   prep:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
     outputs:
@@ -41,13 +42,16 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Resolve version & tag
         id: vars
         shell: bash
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
           if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            RAW="${{ inputs.version }}"
+            RAW="${INPUT_VERSION}"
           else
             RAW="${GITHUB_REF_NAME}"  # e.g. vacs-data-v1.2.3
           fi
@@ -85,6 +89,7 @@ jobs:
 
   generate-changelog:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
     outputs:
@@ -94,6 +99,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Generate a changelog
         uses: orhun/git-cliff-action@c93ef52f3d0ddcdcc9bd5447d98d458a11cd4f72 # v4.7.1
@@ -102,10 +108,39 @@ jobs:
           config: tools/cliff.toml
           args: -vv --latest --no-exec --github-repo ${{ github.repository }}
 
+  licenses:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Rust toolchain
+        run: rustup toolchain install stable --profile minimal --no-self-update
+
+      - name: Install cargo-about
+        run: cargo install cargo-about --locked
+
+      - name: Generate third-party license file
+        run: cargo about generate --workspace -o THIRD_PARTY_LICENSES.html about.hbs
+
+      - name: Upload licenses artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: third-party-licenses
+          path: THIRD_PARTY_LICENSES.html
+          if-no-files-found: error
+          retention-days: 30
+
   build:
     needs: [prep]
     name: Build ${{ matrix.platform }}
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     permissions:
       contents: read
       attestations: write
@@ -132,9 +167,9 @@ jobs:
           persist-credentials: false
 
       - name: Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
+        run: |
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup target add ${{ matrix.target }}
 
       - name: Cache cargo
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
@@ -144,14 +179,17 @@ jobs:
 
       - name: Set binary name
         id: vars
+        env:
+          PLATFORM: ${{ matrix.platform }}
+          VERSION: ${{ needs.prep.outputs.version }}
         run: |
           EXT=""
-          if [[ "${{ matrix.platform }}" == *"windows"* ]]; then
+          if [[ "$PLATFORM" == *"windows"* ]]; then
             EXT=".exe"
           fi
 
           echo "binary_name=vacs-data$EXT" >> "$GITHUB_OUTPUT"
-          echo "release_binary_name=vacs-data-${{ needs.prep.outputs.version }}-${{ matrix.platform }}$EXT" >> "$GITHUB_OUTPUT"
+          echo "release_binary_name=vacs-data-${VERSION}-${PLATFORM}$EXT" >> "$GITHUB_OUTPUT"
 
       - name: Build binary
         run: cargo build --release --locked --bin vacs-data --target ${{ matrix.target }}
@@ -169,19 +207,38 @@ jobs:
           path: |
             tools/target/${{ matrix.target }}/release/${{ steps.vars.outputs.release_binary_name }}
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 # v0.23.0
+        with:
+          path: tools
+          format: spdx-json
+          output-file: sbom.spdx.json
+          upload-artifact: false
+
       - name: Attest build provenance
         if: ${{ !github.event.repository.private || github.event.repository.owner.type == 'Organization' }}
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            tools/target/${{ matrix.target }}/release/${{ steps.vars.outputs.release_binary_name }}
+
+      - name: Attest SBOM
+        if: ${{ !github.event.repository.private || github.event.repository.owner.type == 'Organization' }}
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
           subject-path: |
             tools/target/${{ matrix.target }}/release/${{ steps.vars.outputs.release_binary_name }}
+          sbom-path: sbom.spdx.json
 
   release:
-    needs: [prep, generate-changelog, build]
+    needs: [prep, generate-changelog, build, licenses]
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     if: startsWith(github.ref, 'refs/tags/')
     permissions:
       contents: write
+      attestations: write
+      id-token: write
     steps:
       - name: Download binaries
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
@@ -190,14 +247,42 @@ jobs:
           pattern: vacs-data-*
           merge-multiple: true
 
+      - name: Download license file
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        with:
+          name: third-party-licenses
+          path: dist
+
       - name: Generate checksums
         working-directory: dist
+        env:
+          VERSION: ${{ needs.prep.outputs.version }}
         run: |
+          out="SHA256SUMS-${VERSION}.txt"
+          : > "$out"
           for f in *; do
-            [[ "$f" == *.sha512 ]] && continue
-            shasum -a 512 "$f" > "$f.sha512"
+            [[ "$f" == SHA256SUMS* || "$f" == *.html ]] && continue
+            sum=$(shasum -a 256 "$f" | cut -d' ' -f1)
+            echo "$sum  $f" >> "$out"
           done
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+
+      - name: Sign checksums using Cosign with GitHub OIDC Token
+        working-directory: dist
+        env:
+          VERSION: ${{ needs.prep.outputs.version }}
+        run: |
+          cosign sign-blob --yes \
+            --bundle "SHA256SUMS-${VERSION}.txt.bundle.json" \
+            "SHA256SUMS-${VERSION}.txt"
+
+      - name: Attest release artifacts
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-checksums: dist/SHA256SUMS-${{ needs.prep.outputs.version }}.txt
+
       - name: Create/update GitHub release
         uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
diff --git a/.github/workflows/tag-airac.yml b/.github/workflows/tag-airac.yml
index 29286023..b9088a3f 100644
--- a/.github/workflows/tag-airac.yml
+++ b/.github/workflows/tag-airac.yml
@@ -10,11 +10,14 @@ permissions: {}
 jobs:
   tag:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check for AIRAC cycle
         id: check
diff --git a/README.md b/README.md
index 7842150e..6035eced 100644
--- a/README.md
+++ b/README.md
@@ -40,14 +40,14 @@ The dataset content of this repository is [licensed](LICENSE) under the **[Creat
 
 **This means you are free to:**
 
-- **Share** — copy and redistribute the material in any medium or format.
-- **Adapt** — remix, transform, and build upon the material.
+- **Share** - copy and redistribute the material in any medium or format.
+- **Adapt** - remix, transform, and build upon the material.
 
 **Under the following validation terms:**
 
-- **Attribution** — You must give appropriate credit, provide a link to the license, and indicate if changes were made.
-- **NonCommercial** — You may not use the material for commercial purposes.
-- **ShareAlike** — If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.
+- **Attribution** - You must give appropriate credit, provide a link to the license, and indicate if changes were made.
+- **NonCommercial** - You may not use the material for commercial purposes.
+- **ShareAlike** - If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.
 
 ### Tools license
 
diff --git a/tools/.gitignore b/tools/.gitignore
index 674fc7aa..59ad5bd4 100644
--- a/tools/.gitignore
+++ b/tools/.gitignore
@@ -134,3 +134,6 @@ target/
 
 # Patch cargo dependencies to use local vacs packages during development
 /.cargo/config.toml
+
+# Generated license file
+THIRD_PARTY_LICENSES.html
diff --git a/tools/Cargo.lock b/tools/Cargo.lock
index 73452dfa..d933d3ba 100644
--- a/tools/Cargo.lock
+++ b/tools/Cargo.lock
@@ -61,6 +61,18 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "bitflags"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+
 [[package]]
 name = "bumpalo"
 version = "3.19.1"
@@ -162,16 +174,32 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "getrandom"
-version = "0.3.4"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
  "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
 ]
 
 [[package]]
@@ -186,6 +214,12 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -193,7 +227,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
- "hashbrown",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -218,6 +254,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
 [[package]]
 name = "libc"
 version = "0.2.180"
@@ -254,6 +296,16 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
 
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -274,9 +326,9 @@ dependencies = [
 
 [[package]]
 name = "r-efi"
-version = "5.3.0"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "regex"
@@ -313,6 +365,12 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -402,21 +460,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "toml"
-version = "0.9.11+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
-dependencies = [
- "indexmap",
- "serde_core",
- "serde_spanned",
- "toml_datetime 0.7.5+spec-1.1.0",
- "toml_parser",
- "toml_writer",
- "winnow",
-]
-
 [[package]]
 name = "toml"
 version = "1.0.3+spec-1.1.0"
@@ -426,21 +469,12 @@ dependencies = [
  "indexmap",
  "serde_core",
  "serde_spanned",
- "toml_datetime 1.0.0+spec-1.1.0",
+ "toml_datetime",
  "toml_parser",
  "toml_writer",
  "winnow",
 ]
 
-[[package]]
-name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
-dependencies = [
- "serde_core",
-]
-
 [[package]]
 name = "toml_datetime"
 version = "1.0.0+spec-1.1.0"
@@ -509,6 +543,12 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -517,9 +557,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.20.0"
+version = "1.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee48d38b119b0cd71fe4141b30f5ba9c7c5d9f4e7a3a8b4a674e4b6ef789976f"
+checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb"
 dependencies = [
  "getrandom",
  "js-sys",
@@ -553,7 +593,7 @@ dependencies = [
  "encoding_rs_io",
  "serde",
  "serde_json",
- "toml 1.0.3+spec-1.1.0",
+ "toml",
  "vacs-data-diagnostics",
  "vacs-protocol",
  "vacs-vatsim",
@@ -570,8 +610,8 @@ dependencies = [
 
 [[package]]
 name = "vacs-protocol"
-version = "1.1.0"
-source = "git+https://github.com/vacs-project/vacs?branch=v2#5336e4d2af83de97c031c7f9ff0ba95c7b241866"
+version = "0.0.0"
+source = "git+https://github.com/vacs-project/vacs?tag=vacs-server-v2.0.0#dd47a8cb0e628ce778fb1e29a6ee5c8914c0f706"
 dependencies = [
  "serde",
  "serde_json",
@@ -580,14 +620,14 @@ dependencies = [
 
 [[package]]
 name = "vacs-vatsim"
-version = "0.2.1"
-source = "git+https://github.com/vacs-project/vacs?branch=v2#5336e4d2af83de97c031c7f9ff0ba95c7b241866"
+version = "0.0.0"
+source = "git+https://github.com/vacs-project/vacs?tag=vacs-server-v2.0.0#dd47a8cb0e628ce778fb1e29a6ee5c8914c0f706"
 dependencies = [
  "regex",
  "serde",
  "serde_json",
  "thiserror",
- "toml 0.9.11+spec-1.1.0",
+ "toml",
  "tracing",
  "vacs-protocol",
 ]
@@ -601,6 +641,15 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.108"
@@ -646,6 +695,40 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -672,6 +755,88 @@ name = "wit-bindgen"
 version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
 
 [[package]]
 name = "zmij"
diff --git a/tools/Cargo.toml b/tools/Cargo.toml
index 77a18648..c9a79b35 100644
--- a/tools/Cargo.toml
+++ b/tools/Cargo.toml
@@ -23,5 +23,5 @@ tracing-subscriber = { version = "0.3.22", features = ["env-filter", "json"] }
 vacs-data-diagnostics = { path = "./diagnostics" }
 vacs-data-importer = { path = "./importer" }
 vacs-data-validator = { path = "./validator" }
-vacs-protocol = { git = "https://github.com/vacs-project/vacs", branch = "v2", default-features = false, features = ["vatsim"] }
-vacs-vatsim = { git = "https://github.com/vacs-project/vacs", branch = "v2", default-features = false, features = ["coverage"] }
+vacs-protocol = { git = "https://github.com/vacs-project/vacs", tag = "vacs-server-v2.0.0", default-features = false, features = ["vatsim"] }
+vacs-vatsim = { git = "https://github.com/vacs-project/vacs", tag = "vacs-server-v2.0.0", default-features = false, features = ["coverage"] }
diff --git a/tools/about.hbs b/tools/about.hbs
new file mode 100644
index 00000000..c499e9cd
--- /dev/null
+++ b/tools/about.hbs
@@ -0,0 +1,54 @@
+{{! Handlebars template for cargo-about – produces standalone HTML. }}
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>Third-Party Licenses</title>
+    <style>
+        @media (prefers-color-scheme: dark) {
+            body { background: #333; color: white; }
+            a { color: skyblue; }
+        }
+        .container { font-family: sans-serif; max-width: 800px; margin: 0 auto; }
+        .intro { text-align: center; }
+        .licenses-list { list-style-type: none; margin: 0; padding: 0; }
+        .license-used-by { margin-top: -10px; }
+        .license-text { max-height: 200px; overflow-y: scroll; white-space: pre-wrap; }
+    </style>
+</head>
+<body>
+    <main class="container">
+        <div class="intro">
+            <h1>Third-Party Licenses</h1>
+            <p>This document lists the licenses of all third-party Rust crates
+               used by the vacs-data tools.</p>
+        </div>
+
+        <h2>Overview of licenses:</h2>
+        <ul class="licenses-overview">
+        {{#each overview}}
+            <li><a href="#{{id}}">{{name}}</a> ({{count}})</li>
+        {{/each}}
+        </ul>
+
+        <h2>All license text:</h2>
+        <ul class="licenses-list">
+        {{#each licenses}}
+            <li class="license" id="{{id}}">
+                <h3>{{name}}</h3>
+                <h4>Used by:</h4>
+                <ul class="license-used-by">
+                {{#each used_by}}
+                    <li><a href="{{#if crate.repository}}{{crate.repository}}{{else}}https://crates.io/crates/{{crate.name}}{{/if}}">{{crate.name}} {{crate.version}}</a></li>
+                {{/each}}
+                </ul>
+                {{#if text}}
+                <pre class="license-text">{{text}}</pre>
+                {{else}}
+                <pre class="license-text">(license text not available)</pre>
+                {{/if}}
+            </li>
+        {{/each}}
+        </ul>
+    </main>
+</body>
+</html>
diff --git a/tools/about.toml b/tools/about.toml
new file mode 100644
index 00000000..b97fd39a
--- /dev/null
+++ b/tools/about.toml
@@ -0,0 +1,20 @@
+# Priority-ordered list of globally accepted licenses.
+# cargo-about picks the first match, so MIT is preferred over Apache-2.0
+# when a crate offers both.
+accepted = [
+    "MIT",
+    "Apache-2.0",
+]
+
+ignore-build-dependencies = false
+ignore-dev-dependencies = false
+ignore-transitive-dependencies = false
+filter-noassertion = true
+
+private = { ignore = true }
+
+[encoding_rs]
+accepted = ["BSD-3-Clause"]
+
+[unicode-ident]
+accepted = ["Unicode-3.0"]