diff --git a/.github/workflows/exec.yaml b/.github/workflows/exec.yaml
new file mode 100644
index 0000000..5f6a3b0
--- /dev/null
+++ b/.github/workflows/exec.yaml
@@ -0,0 +1,70 @@
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/workflows/exec.yaml
+      - system/exec/**
+    types:
+      - opened
+      - synchronize
+      - closed
+
+env:
+  GRADLE_SUBPROJECT_DIR: system/exec
+  GRADLE_SUBPROJECT: ':system:exec'
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.merged != true
+    steps:
+      - uses: actions/checkout@v7
+      - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
+      - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
+      - run: './gradlew ${{ env.GRADLE_SUBPROJECT }}:build'
+
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      VERSION_CHANGED: ${{ steps.compare.outputs.VERSION_CHANGED }}
+    steps:
+      - { uses: actions/checkout@v7, with: { fetch-depth: 0 } }
+      - { uses: tj-actions/changed-files@v47, id: changed_files }
+      - run: |
+          file=${{ env.GRADLE_SUBPROJECT_DIR }}/version.txt
+          if ! echo '${{ steps.changed_files.outputs.modified_files }}' | tr ' ' '\n' | grep '^'${file}'$'
+          then
+            echo "VERSION_CHANGED=" | tee -a "${GITHUB_OUTPUT}"
+          else
+            echo "VERSION_CHANGED=1" | tee -a "${GITHUB_OUTPUT}"
+          fi
+        id: compare
+
+  publish:
+    permissions:
+      contents: read
+      id-token: write
+    needs:
+      - version
+    if: github.event.pull_request.merged == true && needs.version.outputs.VERSION_CHANGED != ''
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
+      - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: 'us-east-1'
+          role-to-assume: arn:aws:iam::662610805887:role/prod-ssm-gha-read-maven-central-role
+      - run: |
+          params=$(aws ssm get-parameters-by-path --with-decryption --path /maven-central | jq -c)
+          eval $(echo "${params}" | jq -r '.Parameters[] | ("export " + (.Name | gsub("[/-]"; "_")) + "='"'"'" + (.Value | tojson) + "'"'"';")')
+          export ORG_GRADLE_PROJECT_mavenCentralUsername=$(echo ${_maven_central_token} | jq -r | grep -m1 -oP '(?<=<username>).*?(?=</username>)')
+          export ORG_GRADLE_PROJECT_mavenCentralPassword=$(echo ${_maven_central_token} | jq -r | grep -m1 -oP '(?<=<password>).*?(?=</password>)')
+          export ORG_GRADLE_PROJECT_signingInMemoryKey="$(echo ${_maven_central_key} | jq -r)"
+          ./gradlew ${{ env.GRADLE_SUBPROJECT }}:publishToMavenCentral
diff --git a/.github/workflows/picocli-logback-level-mixin.yaml b/.github/workflows/picocli-logback-level-mixin.yaml
index 4d897fa..d21e250 100644
--- a/.github/workflows/picocli-logback-level-mixin.yaml
+++ b/.github/workflows/picocli-logback-level-mixin.yaml
@@ -21,16 +21,13 @@ defaults:
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.merged != true
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: 25
-          cache: gradle
+      - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
       - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
       - run: './gradlew ${{ env.GRADLE_SUBPROJECT }}:build'
-        if: github.event.pull_request.merged != true
+
   version:
     runs-on: ubuntu-latest
     outputs:
@@ -53,17 +50,12 @@ jobs:
       contents: read
       id-token: write
     needs:
-      - build
       - version
     if: github.event.pull_request.merged == true && needs.version.outputs.VERSION_CHANGED != ''
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: 25
-          cache: gradle
+      - { uses: actions/setup-java@v5, with: { distribution: 'temurin', java-version: 25, cache: gradle } }
       - { uses: gradle/actions/setup-gradle@v6, with: { cache-overwrite-existing: true } }
       - uses: aws-actions/configure-aws-credentials@v4
         with:
diff --git a/gradle/buildPlugins/src/main/groovy/info.ankin.projects.library-conventions.gradle b/gradle/buildPlugins/src/main/groovy/info.ankin.projects.library-conventions.gradle
index bd650ea..8dee4a9 100644
--- a/gradle/buildPlugins/src/main/groovy/info.ankin.projects.library-conventions.gradle
+++ b/gradle/buildPlugins/src/main/groovy/info.ankin.projects.library-conventions.gradle
@@ -1,5 +1,4 @@
-import com.vanniktech.maven.publish.Checksum
-import com.vanniktech.maven.publish.DeploymentValidation
+import com.vanniktech.maven.publish.*
 
 plugins {
     id 'info.ankin.projects.conventions'
@@ -27,6 +26,7 @@ aws ssm put-parameter --type SecureString --name /maven-central/key --value file
 ORG_GRADLE_PROJECT_signingInMemoryKeyId=12345678            # Optional
 ORG_GRADLE_PROJECT_signingInMemoryKeyPassword=some_password # If key was created with a password.
  */
+
 boolean propertiesSet() {
     ['mavenCentralUsername', 'mavenCentralPassword', 'signingInMemoryKey'].every {
         project.providers.gradleProperty(it).isPresent()
@@ -35,6 +35,7 @@ boolean propertiesSet() {
 
 if (propertiesSet())
     mavenPublishing {
+        configure(new JavaLibrary(new JavadocJar.None(), new SourcesJar.Sources()))
         // https://vanniktech.github.io/gradle-maven-publish-plugin/central/#uploading-with-automatic-publishing
         publishToMavenCentral(true, DeploymentValidation.VALIDATED)
         signAllPublications()
diff --git a/system/exec/version.txt b/system/exec/version.txt
index cfefe08..8acdd82 100644
--- a/system/exec/version.txt
+++ b/system/exec/version.txt
@@ -1 +1 @@
-0.0.1-SNAPSHOT
+0.0.1