diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 729a67a..c9bac01 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
       - public-main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build-linux:
     name: Build Linux core
@@ -61,6 +64,62 @@ jobs:
           dotnet build Fiberish.X86/Fiberish.X86.csproj -c Debug -r win-x64
         shell: pwsh
 
+  publish-windows:
+    name: Publish Windows PodishCli NativeAOT
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Publish Windows PodishCli NativeAOT
+        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r win-x64 -p:PublishAot=true -m:1
+        shell: pwsh
+
+      - name: Upload Windows publish artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podishcli-win-x64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/win-x64/publish/**
+
+  publish-linux:
+    name: Publish Linux PodishCli NativeAOT
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install native build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang cmake ninja-build libc++-dev libc++abi-dev
+
+      - name: Publish Linux PodishCli NativeAOT
+        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r linux-x64 -p:PublishAot=true -m:1
+
+      - name: Upload Linux publish artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podishcli-linux-x64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/linux-x64/publish/**
+
   build-macos:
     name: Build macOS full solution
     runs-on: macos-latest
@@ -135,3 +194,32 @@ jobs:
 
       - name: Build full solution
         run: dotnet build Podish.slnx -c Debug -p:EmscriptenToolchainFile="$EMSCRIPTEN_TOOLCHAIN_FILE" -p:BrowserWasmNodeExecutable="$BROWSER_WASM_NODE_EXECUTABLE"
+
+  publish-macos:
+    name: Publish macOS PodishCli NativeAOT
+    runs-on: macos-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install native build dependencies
+        run: |
+          brew install cmake ninja
+
+      - name: Publish macOS PodishCli NativeAOT
+        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r osx-arm64 -p:PublishAot=true -m:1
+
+      - name: Upload macOS publish artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podishcli-osx-arm64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/osx-arm64/publish/**
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9b9ea1..0098c63 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,9 +19,9 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build-macos:
-    name: Build macOS PodishCli NativeAOT
-    runs-on: macos-latest
+  publish-linux:
+    name: Publish Linux PodishCli NativeAOT
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
@@ -40,42 +40,52 @@ jobs:
 
       - name: Install native build dependencies
         run: |
-          brew install cmake ninja
+          sudo apt-get update
+          sudo apt-get install -y clang cmake ninja-build libc++-dev libc++abi-dev
 
-      - name: Publish PodishCli NativeAOT
-        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r osx-arm64 -p:PublishAot=true -m:1
+      - name: Publish Linux PodishCli NativeAOT
+        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r linux-x64 -p:PublishAot=true -m:1
 
-      - name: Package release artifacts
-        shell: bash
-        env:
-          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
-        run: |
-          set -euo pipefail
-          tag="${RELEASE_TAG}"
-          version="${tag#v}"
-          publish_dir="Podish.Cli/bin/Release/net10.0/osx-arm64/publish"
-          staging_dir="$RUNNER_TEMP/PodishCli-$version-osx-arm64"
-          archive_name="PodishCli-$version-osx-arm64-nativeaot.tar.gz"
-          checksum_name="${archive_name}.sha256"
+      - name: Upload Linux publish artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: podishcli-linux-x64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/linux-x64/publish/**
 
-          rm -rf "$staging_dir"
-          mkdir -p "$staging_dir"
-          cp "$publish_dir/Podish.Cli" "$staging_dir/"
-          chmod +x "$staging_dir/Podish.Cli"
+  publish-macos:
+    name: Publish macOS PodishCli NativeAOT
+    runs-on: macos-latest
 
-          tar -C "$RUNNER_TEMP" -czf "$archive_name" "$(basename "$staging_dir")"
-          shasum -a 256 "$archive_name" > "$checksum_name"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
 
-      - name: Upload workflow artifacts
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install native build dependencies
+        run: |
+          brew install cmake ninja
+
+      - name: Publish macOS PodishCli NativeAOT
+        run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r osx-arm64 -p:PublishAot=true -m:1
+
+      - name: Upload macOS publish artifact
         uses: actions/upload-artifact@v4
         with:
-          name: podishcli-osx-arm64-nativeaot
-          path: |
-            PodishCli-*-osx-arm64-nativeaot.tar.gz
-            PodishCli-*-osx-arm64-nativeaot.tar.gz.sha256
+          name: podishcli-osx-arm64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/osx-arm64/publish/**
 
-  build-windows:
-    name: Build Windows PodishCli NativeAOT
+  publish-windows:
+    name: Publish Windows PodishCli NativeAOT
     runs-on: windows-latest
 
     steps:
@@ -93,61 +103,83 @@ jobs:
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Publish PodishCli NativeAOT
+      - name: Publish Windows PodishCli NativeAOT
         run: dotnet publish Podish.Cli/Podish.Cli.csproj -c Release -r win-x64 -p:PublishAot=true -m:1
         shell: pwsh
 
-      - name: Package release artifacts
-        shell: pwsh
-        env:
-          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
-        run: |
-          $ErrorActionPreference = "Stop"
-          $tag = $env:RELEASE_TAG
-          $version = $tag.Substring(1)
-          $publishDir = "Podish.Cli/bin/Release/net10.0/win-x64/publish"
-          $stagingDir = Join-Path $env:RUNNER_TEMP "PodishCli-$version-win-x64"
-          $archiveName = "PodishCli-$version-win-x64-nativeaot.zip"
-          $checksumName = "$archiveName.sha256"
-
-          if (Test-Path $stagingDir) {
-            Remove-Item $stagingDir -Recurse -Force
-          }
-          New-Item -ItemType Directory -Path $stagingDir | Out-Null
-          Copy-Item (Join-Path $publishDir "Podish.Cli.exe") $stagingDir
-
-          if (Test-Path $archiveName) {
-            Remove-Item $archiveName -Force
-          }
-          Compress-Archive -Path "$stagingDir/*" -DestinationPath $archiveName -CompressionLevel Optimal
-          $hash = (Get-FileHash $archiveName -Algorithm SHA256).Hash.ToLowerInvariant()
-          "$hash  $archiveName" | Out-File -FilePath $checksumName -Encoding ascii
-
-      - name: Upload workflow artifacts
+      - name: Upload Windows publish artifact
         uses: actions/upload-artifact@v4
         with:
-          name: podishcli-win-x64-nativeaot
-          path: |
-            PodishCli-*-win-x64-nativeaot.zip
-            PodishCli-*-win-x64-nativeaot.zip.sha256
+          name: podishcli-win-x64-nativeaot-publish
+          path: Podish.Cli/bin/Release/net10.0/win-x64/publish/**
 
   publish-release:
     name: Publish GitHub Release
     runs-on: ubuntu-latest
     needs:
-      - build-macos
-      - build-windows
+      - publish-linux
+      - publish-macos
+      - publish-windows
 
     steps:
-      - name: Download macOS artifacts
+      - name: Download Linux publish artifact
         uses: actions/download-artifact@v4
         with:
-          name: podishcli-osx-arm64-nativeaot
+          name: podishcli-linux-x64-nativeaot-publish
+          path: publish/linux-x64
 
-      - name: Download Windows artifacts
+      - name: Download macOS publish artifact
         uses: actions/download-artifact@v4
         with:
-          name: podishcli-win-x64-nativeaot
+          name: podishcli-osx-arm64-nativeaot-publish
+          path: publish/osx-arm64
+
+      - name: Download Windows publish artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: podishcli-win-x64-nativeaot-publish
+          path: publish/win-x64
+
+      - name: Package release artifacts
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${RELEASE_TAG#v}"
+          rm -rf release-artifacts
+          mkdir -p release-artifacts
+
+          package_tarball() {
+            local rid="$1"
+            local source_dir="publish/$rid"
+            local staging_dir="release-artifacts/podishcli-$version-$rid-nativeaot-publish"
+            local archive="release-artifacts/podishcli-$version-$rid-nativeaot-publish.tar.gz"
+            rm -rf "$staging_dir"
+            mkdir -p "$staging_dir"
+            cp -a "$source_dir"/. "$staging_dir"/
+            if [[ -f "$staging_dir/Podish.Cli" ]]; then
+              chmod +x "$staging_dir/Podish.Cli"
+            fi
+            tar -C release-artifacts -czf "$archive" "$(basename "$staging_dir")"
+            (cd release-artifacts && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
+          }
+
+          package_zip() {
+            local rid="$1"
+            local source_dir="publish/$rid"
+            local staging_dir="release-artifacts/podishcli-$version-$rid-nativeaot-publish"
+            local archive="release-artifacts/podishcli-$version-$rid-nativeaot-publish.zip"
+            rm -rf "$staging_dir" "$archive"
+            mkdir -p "$staging_dir"
+            cp -a "$source_dir"/. "$staging_dir"/
+            python -m zipfile -c "$archive" "$staging_dir"
+            (cd release-artifacts && sha256sum "$(basename "$archive")" > "$(basename "$archive").sha256")
+          }
+
+          package_tarball linux-x64
+          package_tarball osx-arm64
+          package_zip win-x64
 
       - name: Create or update GitHub Release
         env:
@@ -161,8 +193,10 @@ jobs:
             gh release create "$tag" --title "$tag" --generate-notes
           fi
           gh release upload "$tag" \
-            PodishCli-*-osx-arm64-nativeaot.tar.gz \
-            PodishCli-*-osx-arm64-nativeaot.tar.gz.sha256 \
-            PodishCli-*-win-x64-nativeaot.zip \
-            PodishCli-*-win-x64-nativeaot.zip.sha256 \
+            release-artifacts/podishcli-*-linux-x64-nativeaot-publish.tar.gz \
+            release-artifacts/podishcli-*-linux-x64-nativeaot-publish.tar.gz.sha256 \
+            release-artifacts/podishcli-*-osx-arm64-nativeaot-publish.tar.gz \
+            release-artifacts/podishcli-*-osx-arm64-nativeaot-publish.tar.gz.sha256 \
+            release-artifacts/podishcli-*-win-x64-nativeaot-publish.zip \
+            release-artifacts/podishcli-*-win-x64-nativeaot-publish.zip.sha256 \
             --clobber
diff --git a/Podish.Cli/Podish.Cli.csproj b/Podish.Cli/Podish.Cli.csproj
index 5c0c0cd..3b750d4 100644
--- a/Podish.Cli/Podish.Cli.csproj
+++ b/Podish.Cli/Podish.Cli.csproj
@@ -33,8 +33,7 @@
         <SelfContained Condition="'$(PublishAot)' == 'true'">true</SelfContained>
         <StripSymbols Condition="'$(PublishAot)' == 'true'">false</StripSymbols>
         <PodishStaticNative Condition="'$(PublishAot)' == 'true'">true</PodishStaticNative>
-        <PodishNativeBuildDir Condition="'$(RuntimeIdentifier)' == 'osx-arm64'">..\Fiberish.X86\build_native\host</PodishNativeBuildDir>
-        <PodishNativeBuildDir Condition="'$(RuntimeIdentifier)' != '' and '$(RuntimeIdentifier)' != 'osx-arm64'">..\Fiberish.X86\build_native\$(RuntimeIdentifier)</PodishNativeBuildDir>
+        <PodishNativeBuildDir Condition="'$(RuntimeIdentifier)' != ''">..\Fiberish.X86\build_native\$(RuntimeIdentifier)</PodishNativeBuildDir>
         <PodishNativeBuildDir Condition="'$(RuntimeIdentifier)' == ''">..\Fiberish.X86\build_native\host</PodishNativeBuildDir>
         <PodishNetstackTarget Condition="'$(RuntimeIdentifier)' == 'osx-arm64'">aarch64-apple-darwin</PodishNetstackTarget>
         <PodishNetstackTarget Condition="'$(RuntimeIdentifier)' == 'ios-arm64'">aarch64-apple-ios</PodishNetstackTarget>
@@ -48,6 +47,19 @@
         <PodishNetstackStaticLibPath Condition="'$(PodishNetstackTarget)' == ''">..\Fiberish.Netstack\target\release\$(PodishNetstackLibName)</PodishNetstackStaticLibPath>
     </PropertyGroup>
 
+    <Target Name="PrepareNativeAotDependencies"
+            BeforeTargets="Build"
+            Condition="'$(DesignTimeBuild)' != 'true' and '$(PublishAot)' == 'true' and '$(RuntimeIdentifier)' != ''">
+        <MSBuild Projects="..\Fiberish.X86\Fiberish.X86.csproj"
+                 Targets="BuildNativeLib"
+                 BuildInParallel="false"
+                 Properties="Configuration=$(Configuration);RuntimeIdentifier=$(RuntimeIdentifier);PublishAot=$(PublishAot);PodishStaticNative=$(PodishStaticNative);EmscriptenToolchainFile=$(EmscriptenToolchainFile);BrowserWasmNodeExecutable=$(BrowserWasmNodeExecutable)" />
+        <MSBuild Projects="..\Fiberish.Core\Fiberish.Core.csproj"
+                 Targets="BuildNetstackNative"
+                 BuildInParallel="false"
+                 Properties="Configuration=$(Configuration);RuntimeIdentifier=$(RuntimeIdentifier);PublishAot=$(PublishAot);PodishStaticNative=$(PodishStaticNative);FiberishForceBrowserWasm=$(FiberishForceBrowserWasm)" />
+    </Target>
+
     <ItemGroup Condition="'$(PublishAot)' == 'true'">
         <DirectPInvoke Include="fibercpu"/>
         <DirectPInvoke Include="fiberish_netstack"/>
@@ -56,8 +68,16 @@
         <NativeLibrary Include="$(PodishNetstackStaticLibPath)"/>
     </ItemGroup>
 
-    <ItemGroup Condition="'$(PublishAot)' == 'true' and $([MSBuild]::IsOsPlatform('OSX'))">
+    <ItemGroup Condition="'$(PublishAot)' == 'true' and ($([MSBuild]::IsOsPlatform('OSX')) or $([MSBuild]::IsOsPlatform('Linux')))">
         <NativeSystemLibrary Include="c++"/>
     </ItemGroup>
 
+    <ItemGroup Condition="'$(PublishAot)' == 'true' and $([MSBuild]::IsOsPlatform('Linux'))">
+        <NativeSystemLibrary Include="c++abi"/>
+    </ItemGroup>
+
+    <ItemGroup Condition="'$(PublishAot)' == 'true' and $(RuntimeIdentifier.StartsWith('win'))">
+        <NativeLibrary Include="userenv.lib"/>
+    </ItemGroup>
+
 </Project>
diff --git a/libfibercpu/CMakeLists.txt b/libfibercpu/CMakeLists.txt
index d6dc04d..39f3ac8 100644
--- a/libfibercpu/CMakeLists.txt
+++ b/libfibercpu/CMakeLists.txt
@@ -40,6 +40,10 @@ option(FIBERCPU_ENABLE_BLOCK_PROFILE "Enable lightweight per-block execution cou
 option(FIBERCPU_ENABLE_HANDLER_PROFILE "Enable approximate per-handler execution profiling" OFF)
 option(FIBERCPU_ENABLE_SUPEROPCODES "Enable generated SuperOpcode matching and handlers" ON)
 
+if(MSVC AND FIBERCPU_BUILD_STATIC)
+    set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>" CACHE STRING "MSVC runtime library" FORCE)
+endif()
+
 set(FIBERCPU_GENERATED_SUPEROPCODES_FILE
     "${CMAKE_CURRENT_SOURCE_DIR}/src/generated/superopcodes.generated.cpp")