diff --git a/.github/actions/rust-prepare/action.yml b/.github/actions/rust-prepare/action.yml
index aa282d5..f077ca4 100644
--- a/.github/actions/rust-prepare/action.yml
+++ b/.github/actions/rust-prepare/action.yml
@@ -4,25 +4,17 @@ inputs:
   ssh_auth_sock:
     description: "SSH socket"
     default: "/tmp/ssh_agent.sock"
-    required: true
-  gitlab_ssh:
-    description: "Gitlab ssh"
-    required: true
-  gitlab_user:
-    description: "Gitlab username"
-    required: true
-  gitlab_pass:
-    description: "Gitlab username"
-    required: true
   cargo_home:
     description: "Cargo home"
     default: ".cargo"
-  famedly_crates_registry:
+  crate_registry_name:
     description: "Famedly registry name"
     default: "famedly"
-  famedly_crates_registry_index:
+  crate_registry_index_url:
     description: "URL of famedly registry index"
     default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+  crate_registry_ssh_privkey:
+    description: "SSH private key for authenticating with famedly registry index. This needs to be set for a private registry to be configured."
   additional_packages:
     description: "Additional package to install during preparation"
     default: ""
@@ -33,19 +25,9 @@ runs:
     - shell: bash
       env:
         SSH_AUTH_SOCK: ${{ inputs.ssh_auth_sock }}
-        GITLAB_SSH: ${{ inputs.gitlab_ssh }}
-      run: $GITHUB_ACTION_PATH/prepare_ssh.sh
-
-    - shell: bash
-      env:
-        GITLAB_USER: ${{ inputs.gitlab_user }}
-        GITLAB_PASS: ${{ inputs.gitlab_pass }}
-      run: $GITHUB_ACTION_PATH/prepare_git.sh
-
-    - shell: bash
-      env:
         CARGO_HOME: ${{ inputs.cargo_home }}
         ADDITIONAL_PACKAGES: ${{ inputs.additional_packages }}
-        FAMEDLY_CRATES_REGISTRY: ${{ inputs.famedly_crates_registry }}
-        FAMEDLY_CRATES_REGISTRY_INDEX: ${{ inputs.famedly_crates_registry_index }}
-      run: $GITHUB_ACTION_PATH/prepare_rust.sh
+        CRATE_REGISTRY_NAME: ${{ inputs.crate_registry_name }}
+        CRATE_REGISTRY_INDEX_URL: ${{ inputs.crate_registry_index_url }}
+        CRATE_REGISTRY_SSH_PRIVKEY: ${{ inputs.crate_registry_ssh_privkey }}
+      run: $GITHUB_ACTION_PATH/prepare.sh
diff --git a/.github/actions/rust-prepare/prepare.sh b/.github/actions/rust-prepare/prepare.sh
new file mode 100644
index 0000000..d86576d
--- /dev/null
+++ b/.github/actions/rust-prepare/prepare.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "Preparing Rust build environment"
+
+# Ensure repo path is safe
+git config --global --add safe.directory "$(pwd)"
+
+# Determine sudo availability (works inside and outside containers)
+if [[ "$(id -u)" -eq 0 ]]; then
+	SUDO=""
+else
+	SUDO="sudo"
+fi
+
+if [[ -n "${ADDITIONAL_PACKAGES:-}" ]]; then
+  echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
+	# We want to be explicit about word splitting here.
+	# https://github.com/koalaman/shellcheck/wiki/Sc2046
+	read -ra packages <<< "${ADDITIONAL_PACKAGES}"
+	$SUDO apt-get install -yqq --no-install-recommends "${packages[@]}"
+else
+	echo "No additional packages specified. Skipping installation."
+fi
+
+
+# TODO: Don't set CARGO_HOME to a relative path. It is supposed to be an absolute path, this is potentially problematic.
+# However, it works for now and any change to this needs to be thoroughly tested as github actions is really weird about runner home directories.
+echo "Setting up build environment"
+echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
+mkdir -p "${HOME}/${CARGO_HOME}"
+
+# Decide public/private mode based on presence of private key
+if [[ -z "${CRATE_REGISTRY_SSH_PRIVKEY:-}" ]]; then
+	echo "No private registry SSH key provided. Configuring for public builds."
+	export CRATE_REGISTRY_NAME="crates-io"
+else
+	echo "Private registry credentials detected. Configuring SSH and private registry access."
+	USER_NAME="$(whoami)"
+	SSH_HOME="$(getent passwd "$USER_NAME" | cut -d: -f6)"
+	ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
+	echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
+	ssh-add -vvv - <<< "${CRATE_REGISTRY_SSH_PRIVKEY}"$'\n'
+	mkdir -p "$SSH_HOME/.ssh"
+	{
+		ssh-keyscan -H ssh.shipyard.rs
+	} >> "$SSH_HOME/.ssh/known_hosts"
+fi
+
+cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[net]
+git-fetch-with-cli = true
+EOF
+
+if [ "$CRATE_REGISTRY_NAME" != "crates-io" ]; then
+	cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
+[registries.${CRATE_REGISTRY_NAME}]
+index = "${CRATE_REGISTRY_INDEX_URL}"
+EOF
+fi
+
+echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
+
+# Persist registry settings for subsequent GitHub Actions steps
+echo "CRATE_REGISTRY_NAME=${CRATE_REGISTRY_NAME}" >> "$GITHUB_ENV"
+if [[ -n "${CRATE_REGISTRY_INDEX_URL:-}" ]]; then
+	echo "CRATE_REGISTRY_INDEX_URL=${CRATE_REGISTRY_INDEX_URL}" >> "$GITHUB_ENV"
+fi
+
+echo "Preparations finished"
diff --git a/.github/actions/rust-prepare/prepare_git.sh b/.github/actions/rust-prepare/prepare_git.sh
deleted file mode 100755
index ffa3a4a..0000000
--- a/.github/actions/rust-prepare/prepare_git.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-echo "Setting up git credentials"
-echo "https://${GITLAB_USER}:${GITLAB_PASS}@gitlab.com" >> ~/.git-credentials
-git config --global credential.helper store
-git config --global --add safe.directory "$(pwd)"
diff --git a/.github/actions/rust-prepare/prepare_rust.sh b/.github/actions/rust-prepare/prepare_rust.sh
deleted file mode 100755
index 0c2c6c7..0000000
--- a/.github/actions/rust-prepare/prepare_rust.sh
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-# If we are root, there is no sudo command (needed). Makes sure we can run inside a docker container and outside.
-if [[ "$(id -u)" -eq 0 ]]; then
-	SUDO=""
-else
-	SUDO="sudo"
-fi
-
-echo "Installing additional packages: ${ADDITIONAL_PACKAGES}"
-$SUDO apt-get install -yqq --no-install-recommends "${ADDITIONAL_PACKAGES}"
-
-echo "Setting up development environment"
-
-echo "CARGO_HOME = ${HOME}/${CARGO_HOME}"
-mkdir -p "${HOME}/${CARGO_HOME}"
-
-cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
-[net]
-git-fetch-with-cli = true
-EOF
-
-if [ "$FAMEDLY_CRATES_REGISTRY" != "crates-io" ]; then
-    cat << EOF >> "${HOME}/${CARGO_HOME}/config.toml"
-[registries.${FAMEDLY_CRATES_REGISTRY}]
-index = "${FAMEDLY_CRATES_REGISTRY_INDEX}"
-EOF
-fi
-
-echo "CARGO_HOME=${HOME}/${CARGO_HOME}" >> "$GITHUB_ENV"
-
-echo "Preparations finished"
diff --git a/.github/actions/rust-prepare/prepare_ssh.sh b/.github/actions/rust-prepare/prepare_ssh.sh
deleted file mode 100755
index 64a214b..0000000
--- a/.github/actions/rust-prepare/prepare_ssh.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-echo "Preparing Rust build environment"
-
-echo "Setting up SSH"
-USER="$(whoami)"
-SSH_HOME="$(getent passwd "$USER" | cut -d: -f6)" # Is different from $HOME in docker containers, because github CI..
-ssh-agent -a "${SSH_AUTH_SOCK}" > /dev/null
-echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "$GITHUB_ENV"
-ssh-add -vvv - <<< "${GITLAB_SSH}"$'\n' # ensure newline at the end of key
-
-echo "Adding public keys of remotes our CI interacts with"
-mkdir -p "$SSH_HOME/.ssh"
-
-{
-    ssh-keyscan -H gitlab.com
-    ssh-keyscan -H github.com
-    ssh-keyscan -H ssh.shipyard.rs
-} >> "$SSH_HOME/.ssh/known_hosts"
diff --git a/.github/workflows/docker-backend.yml b/.github/workflows/docker-backend.yml
index b435eb8..1b87332 100644
--- a/.github/workflows/docker-backend.yml
+++ b/.github/workflows/docker-backend.yml
@@ -12,29 +12,27 @@ on:
         required: true
         type: string
 
-      registry_user:
+      oci_registry_user:
         required: false
         type: string
-        default: ${{ vars.REGISTRY_USER }}
+        default: ${{ vars.OCI_REGISTRY_USER }}
 
     secrets:
-      CI_SSH_PRIVATE_KEY:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
-          either be fetched from private GitHub repositories or a
-          private registry.
-      registry_password:
+          be fetched from a private registry.
+      OCI_REGISTRY_PASSWORD:
         required: false
         description: |
           The password to use to push to the docker registry. If left
           unset, the GitHub token will be used instead.
 
 env:
-  RUSTC_WRAPPER: cachepot
-  REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
-  REGISTRY_RELEASES: registry.famedly.net/docker-releases
-  REGISTRY_OSS: registry.famedly.net/docker-oss
+  OCI_REGISTRY_SNAPSHOTS: registry.famedly.net/docker-nightly
+  OCI_REGISTRY_RELEASES: registry.famedly.net/docker-releases
+  OCI_REGISTRY_OSS: registry.famedly.net/docker-oss
 
 jobs:
   docker-publish:
@@ -47,9 +45,9 @@ jobs:
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan github.com >> ~/.ssh/known_hosts
+          ssh-keyscan git.shipyard.rs >> ~/.ssh/known_hosts
           ssh-agent -a $SSH_AUTH_SOCK > /dev/null
-          ssh-add - <<< "${{ secrets.CI_SSH_PRIVATE_KEY }}" || true
+          ssh-add - <<< "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}" || true
 
       # TODO: consider adding an intermediate `docker build -t base_image --target base` step
       # if current version rebuilds base stage for each target without caching. Ideally we want
@@ -65,35 +63,35 @@ jobs:
             echo "::group::Building ${target}"
 
             docker build --pull -t ${target} --target ${target} \
-              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CARGO_REGISTRIES_FAMEDLY_INDEX }}" \
+              --build-arg CARGO_REGISTRIES_FAMEDLY_INDEX="${{ vars.CRATE_REGISTRY_INDEX_URL }}" \
               --build-arg CARGO_BUILD_RUSTFLAGS="${CARGO_BUILD_RUSTFLAGS}" \
               --ssh default .
 
             echo "::endgroup::"
           done
 
-      - name: Resolve registry to push
+      - name: Resolve OCI registry to push
         shell: bash
         run: |
           if [ ${{ github.ref_type }} = 'branch' ]; then
-            echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+            echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
           elif [ ${{ github.ref_type }} = 'tag' ]; then
             if [[ ${{ inputs.oss }} == true ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_OSS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_OSS }}" >> $GITHUB_ENV
             else
-              echo "REGISTRY=${{ env.REGISTRY_RELEASES }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_RELEASES }}" >> $GITHUB_ENV
             fi
             if ! [[ ${{ github.ref_name }} =~ v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
-              echo "REGISTRY=${{ env.REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
+              echo "OCI_REGISTRY=${{ env.OCI_REGISTRY_SNAPSHOTS }}" >> $GITHUB_ENV
             fi
           fi
 
       - name: Tag
         shell: bash
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Tagging ${IMAGE_PATH}"
 
             if [ ${{ github.ref_type }} = 'branch' ]; then
@@ -113,20 +111,20 @@ jobs:
             echo "::endgroup::"
           done
 
-      - name: Log into registry ${{ env.REGISTRY }}
+      - name: Log into registry ${{ env.OCI_REGISTRY }}
         uses: famedly/login-action@v2
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ inputs.registry_user }}
-          password: ${{ secrets.registry_password || secrets.GITHUB_TOKEN }}
+          registry: ${{ env.OCI_REGISTRY }}
+          username: ${{ inputs.oci_registry_user }}
+          password: ${{ secrets.OCI_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
 
       - name: Push
-        if: env.REGISTRY != null
+        if: env.OCI_REGISTRY != null
         shell: bash
         run: |
           for target in $(echo "${{ inputs.targets }}" | tr ',' '\n'); do
-            IMAGE_PATH="${{ env.REGISTRY }}/${target}"
+            IMAGE_PATH="${{ env.OCI_REGISTRY }}/${target}"
             echo "::group::Pushing ${IMAGE_PATH}"
             docker image push --all-tags "${IMAGE_PATH}"
             echo "::endgroup::"
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index 21247b9..e9c7a4c 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -15,14 +15,14 @@ name: Publish Rust crates
 on:
   workflow_call:
     inputs:
-      registry-name:
+      crate_registry_name:
         description: "Name of the registry to publish to"
         type: string
-        default: "famedly"
-      registry-index:
+        default: "${{ vars.CRATE_REGISTRY_NAME }}"
+      crate_registry_index_url:
         description: "URL of the registry index"
         type: string
-        default: "ssh://git@ssh.shipyard.rs/famedly/crate-index.git"
+        default: "${{ vars.CRATE_REGISTRY_INDEX_URL }}"
       packages:
         description: "List of packages to publish; space-separated list"
         type: string
@@ -30,10 +30,10 @@ on:
         description: "List of features to publish; space-separated list"
         type: string
     secrets:
-      CI_SSH_PRIVATE_KEY:
-        description: "SSH key to use for authentication against the crate index"
+      CRATE_REGISTRY_SSH_PRIVKEY:
+        description: "SSH key to use for authentication against the registry crate index"
         required: true
-      registry-auth-token:
+      CRATE_REGISTRY_AUTH_TOKEN:
         description: "Auth token for the registry to publish to"
         required: true
 
@@ -42,26 +42,24 @@ jobs:
     # Enforce only publishing tagged commits
     if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
-    container: registry.famedly.net/docker-oss/rust-container:nightly
+    container: ghcr.io/famedly/rust-container:nightly
     steps:
       - uses: actions/checkout@v4
-      - uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main
+      - uses: ./.github/actions/rust-prepare
         with:
-          gitlab_user: ${{ secrets.GITLAB_USER }}
-          gitlab_pass: ${{ secrets.GITLAB_PASS }}
-          gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY }}
-          famedly_crates_registry: ${{ inputs.registry-name }}
-          famedly_crates_registry_index: ${{ inputs.registry-index }}
+          crate_registry_name: ${{ inputs.crate_registry_name }}
+          crate_registry_index_url: ${{ inputs.crate_registry_index_url }}
+          crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
       - name: Install registry token
         # Uses `echo` (bash built-in) to prevent leaking the token
         # through CLI args in /proc
         run: |
           cat << EOF > "${CARGO_HOME}/credentials.toml"
-          [${{ inputs.registry-name != 'crates-io' && format('registries.{0}', inputs.registry-name) || 'registry' }}]
-          token = "${{ secrets.registry-auth-token }}"
+          [${{ inputs.crate_registry_name != 'crates-io' && format('registries.{0}', inputs.crate_registry_name) || 'registry' }}]
+          token = "${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}"
           EOF
       - name: Publish
         run: |
-          cargo publish ${{ inputs.registry-name != 'crates-io' && format('--registry {0}', inputs.registry-name) || '' }} \
+          cargo publish ${{ inputs.crate_registry_name != 'crates-io' && format('--registry {0}', inputs.crate_registry_name) || '' }} \
             ${{ inputs.packages != null && format('--package {0}', inputs.packages) || '' }} \
             ${{ inputs.features != null && format('--features {0}', inputs.features) || '' }}
diff --git a/.github/workflows/rust-workflow.yml b/.github/workflows/rust-workflow.yml
index a87d34f..8e0bf95 100644
--- a/.github/workflows/rust-workflow.yml
+++ b/.github/workflows/rust-workflow.yml
@@ -3,12 +3,12 @@ name: Rust workflow
 on:
   workflow_call:
     inputs:
-      runs-on:
+      runs_on:
         required: false
         type: string
         default: ubuntu-latest
 
-      run-doctests:
+      run_doctests:
         description: |
           Whether to run doctests.
 
@@ -27,12 +27,11 @@ on:
         type: string
 
     secrets:
-      CI_SSH_PRIVATE_KEY:
+      CRATE_REGISTRY_SSH_PRIVKEY:
         required: false
         description: |
           Private SSH key to use for cargo dependencies that need to
-          either be fetched from private GitHub repositories or a
-          private registry.
+          be fetched from a private registry.
       CODECOV_TOKEN:
         required: false
         description: |
@@ -49,8 +48,8 @@ env:
 # Defined CI jobs.
 jobs:
   rust-lints:
-    runs-on: ${{ inputs.runs-on }}
-    container: registry.famedly.net/docker-oss/rust-container:nightly
+    runs-on: ${{ inputs.runs_on }}
+    container: ghcr.io/famedly/rust-container:nightly
     steps:
     - name: Checkout workflow dependencies
       uses: actions/checkout@v4
@@ -60,9 +59,7 @@ jobs:
 
     - uses: ./.github/actions/rust-prepare
       with:
-        gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY}}
-        gitlab_user: ${{ secrets.GITLAB_USER }}
-        gitlab_pass: ${{ secrets.GITLAB_PASS }}
+        crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -87,7 +84,7 @@ jobs:
       run: typos # TODO: Use the typos action
 
   rust-tests:
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ${{ inputs.runs_on }}
     container: registry.famedly.net/docker-oss/rust-container:nightly
     steps:
     - name: Checkout workflow dependencies
@@ -96,11 +93,9 @@ jobs:
         repository: famedly/backend-build-workflows
         ref: ${{ inputs.ref }}
 
-    - uses: ./.github/actions/rust-prepare
+    - uses: ./.github/actions/rust-prepare@v4
       with:
-        gitlab_ssh: ${{ secrets.CI_SSH_PRIVATE_KEY}}
-        gitlab_user: ${{ secrets.GITLAB_USER }}
-        gitlab_pass: ${{ secrets.GITLAB_PASS }}
+        crate_registry_ssh_privkey: ${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY}}
 
     - name: Checkout the repository to test
       uses: actions/checkout@v4
@@ -114,7 +109,7 @@ jobs:
 
     - name: Doc-test
       shell: bash
-      if: inputs.run-doctests
+      if: inputs.run_doctests
       run: cargo +${NIGHTLY_VERSION} test --doc --workspace --verbose ${{inputs.test_args}}
 
     - name: Codecov - Upload coverage
diff --git a/README.md b/README.md
index dc19b41..cbef3cc 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,26 @@ jobs:
       name: bar # name of service
 ```
 
+## GitHub Actions variables and secrets (v4)
+
+### Variables
+
+| Name | Where it is consumed | Required | Purpose |
+| --- | --- | --- | --- |
+| `OCI_REGISTRY_USER` | docker-backend: default value for workflow input `inputs.oci_registry_user` | Optional | Username for logging into the target OCI registry. |
+| `CRATE_REGISTRY_NAME` | rust-prepare: default value for action input `inputs.crate_registry_name` | Optional | Name of the crate registry to configure (e.g., `famedly` or `crates-io`). |
+| `CRATE_REGISTRY_INDEX_URL` | rust-prepare: default value for action input `inputs.crate_registry_index_url`; docker-backend: passed to Docker as build-arg `CARGO_REGISTRIES_FAMEDLY_INDEX` | Optional | URL of the crate registry index used by the action and inside Docker builds. |
+
+### Secrets
+
+| Name | Used by | Required | Purpose |
+| --- | --- | --- | --- |
+| `CRATE_REGISTRY_SSH_PRIVKEY` | `.github/workflows/docker-backend.yml`, `.github/workflows/publish-crate.yml`, `.github/workflows/rust-workflow.yml` | Required in `publish-crate`; optional elsewhere | SSH private key for accessing the private crate registry index. |
+| `CRATE_REGISTRY_AUTH_TOKEN` | `.github/workflows/publish-crate.yml` | Required for publish-crate workflow | Auth token used when publishing crates to the configured registry. |
+| `OCI_REGISTRY_PASSWORD` | `.github/workflows/docker-backend.yml` | Optional (falls back to `GITHUB_TOKEN`) | Password for logging into the target OCI registry when pushing images. |
+| `CODECOV_TOKEN` | `.github/workflows/rust-workflow.yml` | Optional | Token for uploading coverage and test results to Codecov. |
+| `GITHUB_TOKEN` | `.github/workflows/docker-backend.yml` | Implicit (provided by GitHub) | Fallback token for OCI login when `OCI_REGISTRY_PASSWORD` is not set. |
+
 should take care of everything
 
 ## Complex service with subfolders
@@ -28,3 +48,99 @@ jobs:
       path: ./foo/bar # path to where the Dockerfile resides
       name: bar # name of service
 ```
+
+## Migration guide: v3 → v4
+
+### Summary of breaking changes
+- Inputs, secrets and env vars have been renamed for clarity and consistency.
+- GitHub SSH authentication was removed, only the private Famedly crate registry via SSH is supported. Cargo Git dependencies are *no longer supported*!
+- The `rust-prepare` action is consolidated into a single `prepare.sh` and auto-configures public vs private registry access.
+- All remaining GitLab references have been removed.
+
+### Composite action: `.github/actions/rust-prepare`
+
+| v3 (old) | v4 (new) | Notes |
+| --- | --- | --- |
+| `famedly_crates_registry` | `crate_registry_name` ||
+| `famedly_crates_registry_index` | `crate_registry_index_url` ||
+| (new) | `crate_registry_ssh_privkey` | SSH private key for the private registry index. Optional; when omitted, builds use `crates-io`. |
+| `FAMEDLY_CRATES_REGISTRY` | `CRATE_REGISTRY_NAME` ||
+| `FAMEDLY_CRATES_REGISTRY_INDEX` | `CRATE_REGISTRY_INDEX_URL` ||
+
+Behavioural notes:
+- If `famedly_crate_registry_ssh_privkey` is not provided, the action configures `CARGO_HOME` for public `crates-io` only.
+- Use the action via a branch ref: `famedly/backend-build-workflows/.github/actions/rust-prepare@v4`.
+
+### Workflow: `.github/workflows/docker-backend.yml`
+### Renamed inputs and environment variables
+| v3 (old) | v4 (new) |
+| --- | --- |
+| `inputs.registry_user` | `inputs.oci_registry_user` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.registry_password` | `secrets.OCI_REGISTRY_PASSWORD` |
+| `REGISTRY_SNAPSHOTS/RELEASES/OSS` | `OCI_REGISTRY_SNAPSHOTS/RELEASES/OSS` |
+| `REGISTRY` | `OCI_REGISTRY` |
+
+### Workflow: `.github/workflows/publish-crate.yml`
+#### Renamed inputs and secrets
+
+| v3 (old) | v4 (new) |
+| --- | --- |
+| `uses: famedly/backend-build-workflows/.github/actions/rust-prepare@main` | `@v4` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.registry-auth-token` | `secrets.CRATE_REGISTRY_AUTH_TOKEN` |
+| `with.famedly_crates_registry` | `with.crate_registry_name` | 
+| `with.famedly_crates_registry_index` | `with.crate_registry_index_url` |
+### Workflow: `.github/workflows/rust-workflow.yml`
+#### Renamed inputs
+
+| v3 (old) | v4 (new) |
+| --- | --- |
+| `inputs.runs-on` | `inputs.runs_on` |
+| `inputs.run-doctests` | `inputs.run_doctests` |
+| `secrets.CI_SSH_PRIVATE_KEY` | `secrets.CRATE_REGISTRY_SSH_PRIVKEY` |
+| `secrets.CODECOV_TOKEN` | `secrets.CODECOV_TOKEN` |
+| `uses: ./.github/actions/rust-prepare` | `uses: ./.github/actions/rust-prepare@v4` |
+### Required user actions
+- Update all `uses:` references to the v4 tag.
+- Rename inputs, secrets and env vars as per the tables above.
+- If you rely on private crates in Famedly’s registry, pass `famedly_crate_registry_ssh_privkey` and the registry name/index. Otherwise omit it to use `crates-io`.
+- If you referenced `REGISTRY` variables in custom steps, switch to `OCI_REGISTRY` equivalents.
+
+### Minimal examples (v4)
+
+Prepare rust action, with custom crate registry:
+
+```yaml
+- uses: famedly/backend-build-workflows/.github/actions/rust-prepare@v4
+  with:
+    crate_registry_name: "${{ vars.CRATE_REGISTRY_NAME }}"
+    crate_registry_index_url: "${{ vars.CRATE_REGISTRY_INDEX_URL }}"
+    crate_registry_ssh_privkey: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
+```
+
+Publish crates workflow call:
+
+```yaml
+jobs:
+  publish:
+    uses: famedly/backend-build-workflows/.github/workflows/publish-crate.yml@v4
+    secrets:
+      CRATE_REGISTRY_SSH_PRIVKEY: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
+      CRATE_REGISTRY_AUTH_TOKEN: "${{ secrets.CRATE_REGISTRY_AUTH_TOKEN }}"
+    with:
+```
+
+Docker backend workflow call:
+
+```yaml
+jobs:
+  publish:
+    uses: famedly/backend-build-workflows/.github/workflows/docker-backend.yml@v4
+    with:
+      targets: "service-a,service-b"
+      oci_registry_user: "${{ vars.OCI_REGISTRY_USER }}"
+    secrets:
+      CRATE_REGISTRY_SSH_PRIVKEY: "${{ secrets.CRATE_REGISTRY_SSH_PRIVKEY }}"
+      OCI_REGISTRY_PASSWORD: "${{ secrets.OCI_REGISTRY_PASSWORD }}"
+```