diff --git a/.gitignore b/.gitignore
index bc0e810..bb9d1eb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,25 +7,27 @@ __pycache__/
 *.so
 
 # Distribution / packaging
+.eggs/
+.installed.cfg
+.pdm-build
+.pdm-python
 .Python
+.web/
+*.egg
+*.egg-info/
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
-.eggs/
-.pdm-python
 lib/
 lib64/
+MANIFEST
 parts/
 sdist/
+share/python-wheels/
 var/
 wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
 
 # PyInstaller
 *.manifest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c29570..5edcdf7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,19 +12,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - configure renovatebot for mex-template itself
 - pdm release plugin as additional requirement for template packages
 - github action for releasing a new version in template packages
+- add `.web` folder to ignore files for reflex development
+- add commit signing to release pipeline
 
 ### Changes
 
 - harmonize git and docker ignore files
 - update requirements, actions and sample dependencies
+- set fixed versions in toml for renovatebot
 
 ### Deprecated
 
 ### Removed
 
+- drop npm support from renovate pipeline
+- remove non-functional branch restriction from release pipeline
+
 ### Fixed
 
-- fix `export-all` pdm script
+- fix `export-all` and `install-all` pdm scripts
+- fix wording of release pipeline title
 
 ### Security
 
diff --git a/mex-{{ cookiecutter.project_name }}/.dockerignore b/mex-{{ cookiecutter.project_name }}/.dockerignore
index a982909..3650b7f 100644
--- a/mex-{{ cookiecutter.project_name }}/.dockerignore	
+++ b/mex-{{ cookiecutter.project_name }}/.dockerignore	
@@ -7,24 +7,27 @@ __pycache__/
 *.so
 
 # Distribution / packaging
+.eggs/
+.installed.cfg
+.pdm-build
+.pdm-python
 .Python
+.web/
+*.egg
+*.egg-info/
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
-.eggs/
 lib/
 lib64/
+MANIFEST
 parts/
 sdist/
+share/python-wheels/
 var/
 wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
 
 # PyInstaller
 *.manifest
diff --git a/mex-{{ cookiecutter.project_name }}/.github/workflows/release.yml b/mex-{{ cookiecutter.project_name }}/.github/workflows/release.yml
index 11a301a..8e68e56 100644
--- a/mex-{{ cookiecutter.project_name }}/.github/workflows/release.yml	
+++ b/mex-{{ cookiecutter.project_name }}/.github/workflows/release.yml	
@@ -1,10 +1,9 @@
 name: Release
 
-run-name: release version {% raw %}${{ inputs.version }} by @${{ github.actor }}{% endraw %}
+run-name: bump {% raw %}${{ inputs.version }} version by @${{ github.actor }}{% endraw %}
 
 on:
   workflow_dispatch:
-    branches: ["main"]
     inputs:
       version:
         type: choice
@@ -55,8 +54,27 @@ jobs:
       - name: Install requirements
         run: make setup
 
+      - name: Configure git
+        env:
+          {% raw %}SIGNING_KEY: ${{ secrets.SIGNING_KEY }}{% endraw %}
+          {% raw %}SIGNING_PUB: ${{ secrets.SIGNING_PUB }}{% endraw %}
+        run: |
+          {% raw -%}
+          eval "$(ssh-agent -s)"
+          install --directory ~/.ssh --mode 700
+          base64 -d <<< '${{ secrets.SIGNING_KEY }}' > ~/.ssh/mex
+          base64 -d <<< '${{ secrets.SIGNING_PUB }}' > ~/.ssh/mex.pub
+          chmod 600 ~/.ssh/*
+          ssh-add ~/.ssh/mex
+          git config --local user.email ${{ vars.MEX_BOT_EMAIL }}
+          git config --local user.name ${{ vars.MEX_BOT_USER }}
+          git config --local gpg.format ssh
+          git config --local user.signingkey ~/.ssh/mex.pub
+          git config --local commit.gpgsign true
+          {%- endraw %}
+
       - name: Release new version
+        env:
+          {% raw %}GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}{% endraw %}
         run: |
-          git config --global user.name 'RKIMetadataExchange'
-          git config --global user.email 'mex@rki.de'
           pdm release {% raw %}${{ inputs.version }}{% endraw %}
diff --git a/mex-{{ cookiecutter.project_name }}/.gitignore b/mex-{{ cookiecutter.project_name }}/.gitignore
index bc0e810..bb9d1eb 100644
--- a/mex-{{ cookiecutter.project_name }}/.gitignore	
+++ b/mex-{{ cookiecutter.project_name }}/.gitignore	
@@ -7,25 +7,27 @@ __pycache__/
 *.so
 
 # Distribution / packaging
+.eggs/
+.installed.cfg
+.pdm-build
+.pdm-python
 .Python
+.web/
+*.egg
+*.egg-info/
 build/
 develop-eggs/
 dist/
 downloads/
 eggs/
-.eggs/
-.pdm-python
 lib/
 lib64/
+MANIFEST
 parts/
 sdist/
+share/python-wheels/
 var/
 wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
 
 # PyInstaller
 *.manifest
diff --git a/mex-{{ cookiecutter.project_name }}/.pre-commit-config.yaml b/mex-{{ cookiecutter.project_name }}/.pre-commit-config.yaml
index 8398fbe..784ff9e 100644
--- a/mex-{{ cookiecutter.project_name }}/.pre-commit-config.yaml	
+++ b/mex-{{ cookiecutter.project_name }}/.pre-commit-config.yaml	
@@ -3,11 +3,11 @@ default_language_version:
   python: python3.11
 repos:
   - repo: https://github.com/psf/black
-    rev: 24.3.0
+    rev: 24.4.2
     hooks:
       - id: black
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.3.5
+    rev: v0.4.8
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
@@ -28,7 +28,7 @@ repos:
       - id: fix-byte-order-marker
         name: byte-order
   - repo: https://github.com/pdm-project/pdm
-    rev: 2.13.2
+    rev: 2.15.4
     hooks:
       - id: pdm-lock-check
         name: pdm
diff --git a/mex-{{ cookiecutter.project_name }}/pyproject.toml b/mex-{{ cookiecutter.project_name }}/pyproject.toml
index d08630c..a91095b 100644
--- a/mex-{{ cookiecutter.project_name }}/pyproject.toml	
+++ b/mex-{{ cookiecutter.project_name }}/pyproject.toml	
@@ -9,15 +9,15 @@ urls = { Repository = "https://github.com/robert-koch-institut/mex-{{ cookiecutt
 requires-python = "<3.13,>=3.11"
 dependencies = []
 optional-dependencies.dev = [
-    "black>=24.4.2",
-    "ipdb>=0.13.13",
-    "mypy>=1.10.0",
+    "black==24.4.2",
+    "ipdb==0.13.13",
+    "mypy==1.10.0",
     "pytest-cov>=5.0.0",
-    "pytest-random-order>=1.1.1",
-    "pytest-xdist>=3.6.1",
-    "pytest>=8.2.0",
-    "ruff>=0.4.4",
-    "sphinx>=7.3.7",
+    "pytest-random-order==1.1.1",
+    "pytest-xdist==3.6.1",
+    "pytest==8.2.2",
+    "ruff==0.4.8",
+    "sphinx==7.3.7",
 ]
 
 [project.scripts]
@@ -40,10 +40,10 @@ plugins = ["pydantic.mypy"]
 distribution = true
 
 [tool.pdm.scripts]
-update-all = { cmd = "pdm update --group :all --update-eager --save-minimum" }
-lock-all = { cmd = "pdm lock --group :all" }
-install-all = { cmd = "pdm install --group :all" }
-export-all = { cmd = "pdm export --group :all -f requirements" }
+update-all = { cmd = "pdm update --group :all --update-all --save-compatible" }
+lock-all = { cmd = "pdm lock --group :all --refresh" }
+install-all = { cmd = "pdm install --group :all --no-editable --no-lock" }
+export-all = { cmd = "pdm export --group :all --no-hashes -f requirements" }
 apidoc = { cmd = "pdm run sphinx-apidoc -f -o docs/source mex" }
 sphinx = { cmd = "pdm run sphinx-build -aE -b dirhtml docs docs/dist" }
 doc = { composite = ["apidoc", "sphinx"] }
@@ -126,5 +126,5 @@ known-first-party = ["mex", "tests"]
 convention = "google"
 
 [build-system]
-requires = ["pdm-backend>=2.3.0"]
+requires = ["pdm-backend==2.3.0"]
 build-backend = "pdm.backend"
diff --git a/mex-{{ cookiecutter.project_name }}/renovate.json b/mex-{{ cookiecutter.project_name }}/renovate.json
index 29bddbf..51ce8b8 100644
--- a/mex-{{ cookiecutter.project_name }}/renovate.json	
+++ b/mex-{{ cookiecutter.project_name }}/renovate.json	
@@ -3,7 +3,6 @@
     "enabledManagers": [
         "github-actions",
         "html",
-        "npm",
         "pep621",
         "pip_requirements"
     ],
diff --git a/mex-{{ cookiecutter.project_name }}/requirements.txt b/mex-{{ cookiecutter.project_name }}/requirements.txt
index 2e0fd34..bd9a68c 100644
--- a/mex-{{ cookiecutter.project_name }}/requirements.txt	
+++ b/mex-{{ cookiecutter.project_name }}/requirements.txt	
@@ -1,5 +1,5 @@
 cruft==2.15.0
 mex-release @ git+https://github.com/robert-koch-institut/mex-release.git
-pdm==2.15.3
+pdm==2.15.4
 pre-commit==3.7.1
 wheel==0.43.0
diff --git a/renovate.json b/renovate.json
index 29bddbf..51ce8b8 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,7 +3,6 @@
     "enabledManagers": [
         "github-actions",
         "html",
-        "npm",
         "pep621",
         "pip_requirements"
     ],