diff --git a/.github/workflows/presubmit.yaml b/.github/workflows/presubmit.yaml
index f195334..50b7355 100644
--- a/.github/workflows/presubmit.yaml
+++ b/.github/workflows/presubmit.yaml
@@ -10,16 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
     - name: Set up Java
-      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
       with:
-        java-version: '11'
+        java-version: '21'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       with:
         cache-disabled: true
     # TODO(jradcliff): Add a lint step. Currently blocked by https://github.com/abcxyz/actions/issues/107.
diff --git a/.kokoro/release.cfg b/.kokoro/release.cfg
new file mode 100644
index 0000000..769fe9b
--- /dev/null
+++ b/.kokoro/release.cfg
@@ -0,0 +1,12 @@
+# Format: //devtools/kokoro/config/proto/build.proto
+
+build_file: "github/data-manager-java/.kokoro/release.sh"
+
+before_action {
+  fetch_keystore {
+    keystore_resource {
+      keystore_config_id: 74347
+      keyname: "google_ads_java_gpg_secring"
+    }
+  }
+}
diff --git a/.kokoro/release.sh b/.kokoro/release.sh
new file mode 100755
index 0000000..39efa03
--- /dev/null
+++ b/.kokoro/release.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+set -euo pipefail
+set -x
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${REPO_DIR}"
+
+# Ensure Java 17 is used on Kokoro Ubuntu 22.04 workers (which default to OpenJDK 11)
+if [[ ! -d "/usr/lib/jvm/java-17-openjdk-amd64" ]]; then
+  echo "ERROR: Kokoro worker missing expected OpenJDK 17 at /usr/lib/jvm/java-17-openjdk-amd64" >&2
+  exit 1
+fi
+export JAVA_HOME="/usr/lib/jvm/java-17-openjdk-amd64"
+export PATH="${JAVA_HOME}/bin:${PATH}"
+
+# 1. Clean, Test, Sign, and Publish to Artifact Registry
+# Keyring / ADC handles authentication via the Kokoro BYOSA service account
+# Keystore fetches the PGP signing key from Keystore config 74347
+KEYSTORE_GPG_FILE="${KOKORO_KEYSTORE_DIR:-}/74347_google_ads_java_gpg_secring"
+if [[ -n "${KOKORO_KEYSTORE_DIR:-}" && -f "${KEYSTORE_GPG_FILE}" ]]; then
+  export SIGNING_KEY="$(cat "${KEYSTORE_GPG_FILE}")"
+fi
+
+if [[ -z "${SIGNING_KEY:-}" ]]; then
+  echo "ERROR: SIGNING_KEY is not set and Keystore GPG file is missing (${KEYSTORE_GPG_FILE})." >&2
+  exit 1
+fi
+
+./gradlew clean check publish --no-daemon
+
+# 2. DRY_RUN Check
+if [[ "${DRY_RUN:-false}" == "true" ]]; then
+  echo "=== DRY_RUN is enabled. Artifacts staged in Artifact Registry. ==="
+  echo "Skipping GCS manifest upload to Exit Gate."
+  exit 0
+fi
+
+# 3. Create Exit Gate Release Manifest
+# Maven Central manifests require 'namespace' (groupId) and package 'name' (artifactId)
+cat <<EOF > manifest.json
+{
+  "publish_all": false,
+  "publishing_groups": [
+    {
+      "namespace": "com.google.api-ads",
+      "packages": [
+        {
+          "name": "data-manager-util"
+        }
+      ]
+    }
+  ]
+}
+EOF
+
+# 4. Trigger Exit Gate Release via GCS Manifest
+EXIT_GATE_BUCKET="gs://oss-exit-gate-prod-projects-bucket/measurement-devrel/mavencentral/manifests"
+MANIFEST_NAME="manifest-$(date +%Y%m%d%H%M%S).json"
+
+echo "=== Uploading manifest to ${EXIT_GATE_BUCKET}/${MANIFEST_NAME} ==="
+gcloud storage cp manifest.json "${EXIT_GATE_BUCKET}/${MANIFEST_NAME}"
+
+echo "=== Release successfully triggered to OSS Exit Gate! ==="
diff --git a/data-manager-samples/build.gradle b/data-manager-samples/build.gradle
index d151aa6..481ca95 100644
--- a/data-manager-samples/build.gradle
+++ b/data-manager-samples/build.gradle
@@ -20,8 +20,10 @@ plugins {
     id 'java-library'
 }
 
-sourceCompatibility = 1.8
-targetCompatibility = 1.8
+java {
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+}
 
 repositories {
     // Use Maven Central for resolving dependencies.
diff --git a/data-manager-util/build.gradle b/data-manager-util/build.gradle
index d1b7e8c..432317d 100644
--- a/data-manager-util/build.gradle
+++ b/data-manager-util/build.gradle
@@ -17,17 +17,81 @@
 plugins {
     id 'java-library'
     id 'maven-publish'
+    id 'signing'
+    id 'com.google.cloud.artifactregistry.gradle-plugin' version '2.2.5' apply false
+}
+
+def isPublishing = gradle.startParameter.taskNames.any { it.endsWith('publish') || it.contains('ArtifactRegistry') }
+if (isPublishing) {
+    apply plugin: 'com.google.cloud.artifactregistry.gradle-plugin'
 }
 
 group = 'com.google.api-ads'
 description = 'Utilities for working with the Data Manager API'
 version = '0.4.0'
 
-sourceCompatibility = 1.8
-targetCompatibility = 1.8
+java {
+    sourceCompatibility = JavaVersion.VERSION_1_8
+    targetCompatibility = JavaVersion.VERSION_1_8
+    withSourcesJar()
+    withJavadocJar()
+}
+
+publishing {
+    publications {
+        library(MavenPublication) {
+            from components.java
+            pom {
+                name = 'Google Data Manager API Utilities'
+                description = 'Utilities for working with the Data Manager API'
+                url = 'https://github.com/googleads/data-manager-java'
+                licenses {
+                    license {
+                        name = 'The Apache License, Version 2.0'
+                        url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+                    }
+                }
+                developers {
+                    developer {
+                        id = 'josh'
+                        name = 'Josh Radcliff'
+                        email = 'jradcliff@users.noreply.github.com'
+                        organization = 'Google'
+                        organizationUrl = 'https://www.google.com'
+                    }
+                    developer {
+                        id = 'lindsey'
+                        name = 'Lindsey Volta'
+                        email = 'lindsey-volta@users.noreply.github.com'
+                        organization = 'Google'
+                        organizationUrl = 'https://www.google.com'
+                    }
+                }
+                scm {
+                    connection = 'scm:git:git://github.com/googleads/data-manager-java.git'
+                    developerConnection = 'scm:git:ssh://github.com:googleads/data-manager-java.git'
+                    url = 'https://github.com/googleads/data-manager-java'
+                }
+            }
+        }
+    }
+    repositories {
+        if (isPublishing) {
+            maven {
+                name = 'ExitGateArtifactRegistry'
+                url = uri(findProperty('artifact-registry-url') ?: "artifactregistry://us-maven.pkg.dev/oss-exit-gate-prod/measurement-devrel--mavencentral")
+            }
+        }
+    }
+}
 
-publishing.publications {
-    library(MavenPublication).from components.java
+signing {
+    def signingKey = findProperty("signingKey") ?: System.getenv("SIGNING_KEY")
+    def signingPassword = findProperty("signingPassword") ?: System.getenv("SIGNING_PASSWORD")
+    if (signingKey) {
+        useInMemoryPgpKeys(signingKey, signingPassword)
+        sign publishing.publications.library
+    }
 }
 
 // Creates install "alias".
diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar
index afba109..a4b76b9 100644
Binary files a/gradle/wrapper/gradle-wrapper.jar and b/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 4e86b92..cea7a79 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.12-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
diff --git a/gradlew b/gradlew
index 65dcd68..f3b75f3 100755
--- a/gradlew
+++ b/gradlew
@@ -15,6 +15,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+# SPDX-License-Identifier: Apache-2.0
+#
 
 ##############################################################################
 #
@@ -55,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -83,10 +85,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,10 +133,13 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
+    fi
 fi
 
 # Increase the maximum file descriptors if we can.
@@ -144,7 +147,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045 
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +155,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045 
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -197,11 +200,15 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \
diff --git a/gradlew.bat b/gradlew.bat
index 93e3f59..9d21a21 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -13,6 +13,8 @@
 @rem See the License for the specific language governing permissions and
 @rem limitations under the License.
 @rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
 
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
@@ -43,11 +45,11 @@ set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 
-echo.
-echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail
 
@@ -57,11 +59,11 @@ set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 
 if exist "%JAVA_EXE%" goto execute
 
-echo.
-echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
-echo.
-echo Please set the JAVA_HOME variable in your environment to match the
-echo location of your Java installation.
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
 
 goto fail