diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9c32923..34a24e8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,10 +10,10 @@ on:
 
 env:
   ATTIC_CACHE: ${{ github.ref == 'refs/heads/master' && 'public' || 'ci' }}
-  ATTIC_TOKEN: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
 jobs:
   build-appimage:
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     strategy:
       matrix:
         include:
@@ -39,7 +39,7 @@ jobs:
           endpoint: ${{ secrets.ATTIC_ENDPOINT }}
           cache: ${{ env.ATTIC_CACHE }}
           inputs-from: "."
-          token: ${{ env.ATTIC_TOKEN }}
+          token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
       - name: Build bin-appimage
         run: nix build .#bin-appimage
@@ -62,6 +62,7 @@ jobs:
           path: logos-basecamp-*.AppImage
 
   build-macos-app:
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     runs-on: macos-latest
 
     steps:
@@ -79,7 +80,7 @@ jobs:
           endpoint: ${{ secrets.ATTIC_ENDPOINT }}
           cache: ${{ env.ATTIC_CACHE }}
           inputs-from: "."
-          token: ${{ env.ATTIC_TOKEN }}
+          token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
       - name: Build bin-macos-app
         run: nix build .#bin-macos-app
@@ -100,6 +101,7 @@ jobs:
           path: logos-basecamp-aarch64-unsigned.app.tar.gz
 
   test-linux:
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     strategy:
       matrix:
         include:
@@ -125,12 +127,13 @@ jobs:
           endpoint: ${{ secrets.ATTIC_ENDPOINT }}
           cache: ${{ env.ATTIC_CACHE }}
           inputs-from: "."
-          token: ${{ env.ATTIC_TOKEN }}
+          token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
       - name: Integration test (UI tests)
         run: nix build .#integration-test -L
 
   test-macos:
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     runs-on: macos-latest
 
     steps:
@@ -148,7 +151,7 @@ jobs:
           endpoint: ${{ secrets.ATTIC_ENDPOINT }}
           cache: ${{ env.ATTIC_CACHE }}
           inputs-from: "."
-          token: ${{ env.ATTIC_TOKEN }}
+          token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
       - name: Integration test (UI tests)
         run: nix build .#integration-test-bundle -L
diff --git a/.github/workflows/doctests.yml b/.github/workflows/doctests.yml
index 6d57fee..647ed88 100644
--- a/.github/workflows/doctests.yml
+++ b/.github/workflows/doctests.yml
@@ -49,11 +49,11 @@ concurrency:
 
 env:
   ATTIC_CACHE: ${{ github.ref == 'refs/heads/master' && 'public' || 'ci' }}
-  ATTIC_TOKEN: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
 jobs:
   doctests:
     name: basecamp doc-tests (${{ matrix.os }})
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     strategy:
       fail-fast: false
       matrix:
@@ -80,7 +80,7 @@ jobs:
           endpoint: ${{ secrets.ATTIC_ENDPOINT }}
           cache: ${{ env.ATTIC_CACHE }}
           inputs-from: "."
-          token: ${{ env.ATTIC_TOKEN }}
+          token: ${{ github.ref == 'refs/heads/master' && secrets.ATTIC_TOKEN_PUBLIC || secrets.ATTIC_TOKEN_CI }}
 
       # The portable bundle (#bin-bundle-dir) is relocatable: it carries the app
       # and its Qt runtime, but NOT host graphics libraries (you can't bundle a
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..96ce32d
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+0.2.0-RC3
\ No newline at end of file
diff --git a/flake.lock b/flake.lock
index 63ff278..28bb039 100644
--- a/flake.lock
+++ b/flake.lock
@@ -27180,11 +27180,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782210104,
-        "narHash": "sha256-30N8XKew2+TLvk/5bhfw275t70cI3Zq2i8bghhfnra8=",
+        "lastModified": 1782484430,
+        "narHash": "sha256-gm+SLNULJn1BHMKOP0aOFkX6T/I20ZlzzatB/OhM6AI=",
         "owner": "logos-co",
         "repo": "logos-package-downloader",
-        "rev": "90af05714f093464eee587ddcd1042a24e0fb4ab",
+        "rev": "1e843e72bd7debedc2fd5a295684574189231df7",
         "type": "github"
       },
       "original": {
@@ -27199,11 +27199,11 @@
         "logos-package-downloader": "logos-package-downloader"
       },
       "locked": {
-        "lastModified": 1782404234,
-        "narHash": "sha256-OvOYAyPlElbiWzBl593xFo60aKc/n2RqXe/elYLB6jw=",
+        "lastModified": 1782485023,
+        "narHash": "sha256-4W6TOKNl6ub0Vd9M/jePTWH1aBZLTcGCU2cFYIfFacs=",
         "owner": "logos-co",
         "repo": "logos-package-downloader-module",
-        "rev": "6dbcf341a7c354b14d1a5012b57facfe6b33bc94",
+        "rev": "22b6cd62a81b25cb9b9ec193c880574f80ca7ffb",
         "type": "github"
       },
       "original": {