diff --git a/.github/workflows/dafny_interop_examples_java.yml b/.github/workflows/dafny_interop_examples_java.yml
index 11b6c93218..abe5bc7b6a 100644
--- a/.github/workflows/dafny_interop_examples_java.yml
+++ b/.github/workflows/dafny_interop_examples_java.yml
@@ -59,6 +59,9 @@ jobs:
           git submodule update --init --recursive
           git rev-parse HEAD
 
+      - name: Install Smithy-Dafny codegen dependencies
+        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies
+
       - name: Setup Java 8
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/dafny_interop_java.yml b/.github/workflows/dafny_interop_java.yml
index b01de2d2dc..a04f11539d 100644
--- a/.github/workflows/dafny_interop_java.yml
+++ b/.github/workflows/dafny_interop_java.yml
@@ -59,6 +59,9 @@ jobs:
           git submodule update --init --recursive
           git rev-parse HEAD
 
+      - name: Install Smithy-Dafny codegen dependencies
+        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies
+
       - name: Setup Java 8
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/dafny_interop_test_vector_java.yml b/.github/workflows/dafny_interop_test_vector_java.yml
index dd74c06100..15b66f680d 100644
--- a/.github/workflows/dafny_interop_test_vector_java.yml
+++ b/.github/workflows/dafny_interop_test_vector_java.yml
@@ -68,6 +68,9 @@ jobs:
           git submodule update --init --recursive
           git rev-parse HEAD
 
+      - name: Install Smithy-Dafny codegen dependencies
+        uses: ./.github/actions/install_smithy_dafny_codegen_dependencies
+
       - name: Setup Java ${{ matrix.java-version }}
         uses: actions/setup-java@v5
         with:
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index 79b796bc49..6f7e7f973d 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -1,9 +1,15 @@
 # This workflow runs every weekday at 16:00 UTC (9AM PDT)
 name: Daily CI
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   schedule:
     - cron: "00 16 * * 1-5"
+  pull_request:
+    paths: .github/workflows/daily_ci.yml
 
 jobs:
   getVersion:
diff --git a/.github/workflows/pull.yml b/.github/workflows/pull.yml
index 3f237ee0d0..aa95a53011 100644
--- a/.github/workflows/pull.yml
+++ b/.github/workflows/pull.yml
@@ -1,6 +1,10 @@
 # This workflow runs for every pull request
 name: PR CI
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   pull_request:
 
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 9e49cf1338..2388afaa33 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -1,6 +1,10 @@
 # This workflow runs for every push to main
 name: Push CI
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   push:
     branches:
diff --git a/DynamoDbEncryption/codebuild/release-prod.yml b/DynamoDbEncryption/codebuild/release-prod.yml
index fd71be8cbd..e01f271dd7 100644
--- a/DynamoDbEncryption/codebuild/release-prod.yml
+++ b/DynamoDbEncryption/codebuild/release-prod.yml
@@ -14,6 +14,7 @@ phases:
       - export PATH="$PWD/dafny:$PATH"
       # Switch back to the main directory
       - cd aws-database-encryption-sdk-dynamodb
+      - make -C DynamoDbEncryption mvn_local_deploy_polymorph_dependencies
   pre_build:
     commands:
       # UNIQUE_ID should be passed in as an environment variable. It is used to tie
diff --git a/DynamoDbEncryption/codebuild/release-staging.yml b/DynamoDbEncryption/codebuild/release-staging.yml
index cbe1d9e62f..babcdaae68 100644
--- a/DynamoDbEncryption/codebuild/release-staging.yml
+++ b/DynamoDbEncryption/codebuild/release-staging.yml
@@ -14,6 +14,7 @@ phases:
       - export PATH="$PWD/dafny:$PATH"
       # Switch back to the main directory
       - cd aws-database-encryption-sdk-dynamodb
+      - make -C DynamoDbEncryption mvn_local_deploy_polymorph_dependencies
   pre_build:
     commands:
       # UNIQUE_ID should be passed in as an environment variable. It is used to tie
diff --git a/DynamoDbEncryption/codebuild/sign.yml b/DynamoDbEncryption/codebuild/sign.yml
index 92f4e61c3f..87e31e7865 100644
--- a/DynamoDbEncryption/codebuild/sign.yml
+++ b/DynamoDbEncryption/codebuild/sign.yml
@@ -14,6 +14,7 @@ phases:
       - export PATH="$PWD/dafny:$PATH"
       # Switch back to the main directory
       - cd aws-database-encryption-sdk-dynamodb
+      - make -C DynamoDbEncryption mvn_local_deploy_polymorph_dependencies
   pre_build:
     commands:
       # UNIQUE_ID should be passed in as an environment variable. It is used to tie
diff --git a/DynamoDbEncryption/codebuild/test-prod.yml b/DynamoDbEncryption/codebuild/test-prod.yml
index e9fc45f1bf..bf5cf163bf 100644
--- a/DynamoDbEncryption/codebuild/test-prod.yml
+++ b/DynamoDbEncryption/codebuild/test-prod.yml
@@ -14,6 +14,7 @@ phases:
       - export PATH="$PWD/dafny:$PATH"
       # Switch back to the main directory
       - cd aws-database-encryption-sdk-dynamodb
+      - make -C DynamoDbEncryption mvn_local_deploy_polymorph_dependencies
   pre_build:
     commands:
       - cd DynamoDbEncryption
diff --git a/DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj b/DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj
index 1ff91a7984..b451e73b36 100644
--- a/DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj
+++ b/DynamoDbEncryption/runtimes/net/DynamoDbEncryption.csproj
@@ -57,17 +57,18 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="AWSSDK.DynamoDBv2" Version="3.7.402.2"/>
-    <PackageReference Include="AWSSDK.Core" Version="3.7.400.38"/>
     <PackageReference Include="DafnyRuntime" Version="$(DafnyVersion)" />
+    <!-- See https://learn.microsoft.com/en-us/nuget/concepts/package-versioning?tabs=semver20sort#version-ranges   -->
+    <PackageReference Include="AWSSDK.Core" Version="[3.7.*, 4.0)" />
+    <PackageReference Include="AWSSDK.DynamoDBv2" Version="[3.7.*, 4.0)" />
     <ProjectReference Include="../../../submodules/MaterialProviders/AwsCryptographicMaterialProviders/runtimes/net/MPL.csproj"/>
     <!--
-              System.Collections.Immutable can be removed once dafny.msbuild is updated with
-              https://github.com/dafny-lang/dafny.msbuild/pull/10 and versioned
-            -->
-    <PackageReference Include="System.Collections.Immutable" Version="1.7.0"/>
+      System.Collections.Immutable can be removed once dafny.msbuild is updated with
+      https://github.com/dafny-lang/dafny.msbuild/pull/10 and versioned
+    -->
+    <PackageReference Include="System.Collections.Immutable" Version="1.7.0" />
     <!-- Work around for dafny-lang/dafny/issues/1951; remove once resolved -->
-    <PackageReference Include="System.ValueTuple" Version="4.6.1"/>
+    <PackageReference Include="System.ValueTuple" Version="4.6.1" />
 
     <Compile Include="Extern/**/*.cs"/>
     <Compile Include="Generated/**/*.cs"/>
diff --git a/project.properties b/project.properties
index 39f9cb1460..df074b2249 100644
--- a/project.properties
+++ b/project.properties
@@ -1,5 +1,5 @@
 projectJavaVersion=3.9.0-SNAPSHOT
-mplDependencyJavaVersion=1.11.1-SNAPSHOT
+mplDependencyJavaVersion=1.11.2-SNAPSHOT
 dafnyVersion=4.9.0
 dafnyVerifyVersion=4.9.1
 dafnyRuntimeJavaVersion=4.9.0
diff --git a/submodules/MaterialProviders b/submodules/MaterialProviders
index 03c999c724..734c1a31fc 160000
--- a/submodules/MaterialProviders
+++ b/submodules/MaterialProviders
@@ -1 +1 @@
-Subproject commit 03c999c72426158b06988cc31155454808d6baa1
+Subproject commit 734c1a31fc4521dc0653433565d5d6171e61d1ac