diff --git a/.github/workflows/maven-publish.yml b/.github/workflows/maven-publish.yml
new file mode 100644
index 0000000..04afb11
--- /dev/null
+++ b/.github/workflows/maven-publish.yml
@@ -0,0 +1,48 @@
+name: Publish to Maven Central
+
+# Manually publish the current POM version to Maven Central, without creating a
+# GitHub release or Docker image (use this to publish a version that was already
+# tagged/released on GitHub, e.g. 4.8). Select the branch to run from in the
+# "Run workflow" dropdown — it publishes whatever version the checked-out POM has.
+#
+# NOTE: Maven Central versions are immutable. Only run this from a branch whose
+# build produces the thin main jar (i.e. after the thin-jar change is merged).
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Never deploy two publishes to Central at the same time; queue instead of racing.
+concurrency:
+  group: maven-central-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+
+    - name: Set up JDK 11
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      with:
+        java-version: '11'
+        distribution: 'temurin'
+        cache: 'maven'
+        server-id: central
+        server-username: MAVEN_USERNAME
+        server-password: MAVEN_PASSWORD
+        gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+        gpg-passphrase: GPG_PASSPHRASE
+
+    - name: Build and deploy to Maven Central
+      run: mvn -B clean deploy -DskipTests
+      env:
+        MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+        MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+        GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 319eabf..daa930b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,11 +43,19 @@ jobs:
         MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
         GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
-    # Upload the JAR as a release asset
+    # The published Maven artifact is now the thin jar; use the runnable "shaded" jar as the
+    # downloadable CLI release asset, keeping the familiar TestingBotTunnel-<version>.jar name.
+    - name: Prepare runnable jar for release
+      run: |
+        VERSION=${GITHUB_REF#refs/tags/v}
+        mkdir -p release-assets
+        cp target/TestingBotTunnel-${VERSION}-shaded.jar release-assets/TestingBotTunnel-${VERSION}.jar
+
+    # Upload the runnable JAR as a release asset
     - name: Upload JAR to GitHub Releases
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
       with:
-        files: target/TestingBotTunnel-*.jar
+        files: release-assets/TestingBotTunnel-*.jar
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/Dockerfile b/Dockerfile
index 89d62b7..4b2e09b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ RUN mvn -B -ntp -DskipTests \
         -Dmaven.javadoc.skip=true \
         -Dmaven.source.skip=true \
         package \
-    && mv target/TestingBotTunnel-*.jar target/testingbot-tunnel.jar
+    && mv target/TestingBotTunnel-*-shaded.jar target/testingbot-tunnel.jar
 
 # -------- Runtime stage --------
 FROM eclipse-temurin:11-jre-jammy
diff --git a/pom.xml b/pom.xml
index 945f394..94edf6a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -146,6 +146,12 @@
               <goal>shade</goal>
             </goals>
             <configuration>
+              <!-- Publish a thin main artifact (project classes only, with dependencies declared
+                   in the POM) so Maven consumers such as the Jenkins plugin get the real, correctly
+                   versioned dependencies transitively instead of a fat jar that shadows them.
+                   The runnable uber jar is attached under the "shaded" classifier for CLI/Docker use. -->
+              <shadedArtifactAttached>true</shadedArtifactAttached>
+              <shadedClassifierName>shaded</shadedClassifierName>
               <minimizeJar>true</minimizeJar>
               <filters>
                 <filter>
@@ -254,7 +260,7 @@
               <executable>java</executable>
               <arguments>
                 <argument>-jar</argument>
-                <argument>${project.build.directory}/${project.build.finalName}.jar</argument>
+                <argument>${project.build.directory}/${project.build.finalName}-shaded.jar</argument>
                 <argument>--version</argument>
               </arguments>
             </configuration>