diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 9688eb2..380a313 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,10 @@
 name: CI
 on:
   pull_request:
+  push:
+    branches:
+      - main
+      - 3.*
 
 env:
   FORCE_COLOR: "1"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d56aa8f..2f9cd34 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -55,15 +55,17 @@ jobs:
       run: |
         PYTHON_VERSION=$(grep "Python version:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 3)
         BZIP2_VERSION=$(grep "BZip2:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
-        XZ_VERSION=$(grep "XZ:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
-        OPENSSL_VERSION=$(grep "OpenSSL:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
         LIBFFI_VERSION=$(grep "libFFI:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
+        MPDECIMAL_VERSION=$(grep "mpdecimal:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
+        OPENSSL_VERSION=$(grep "OpenSSL:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
+        XZ_VERSION=$(grep "XZ:" support/${{ steps.build-vars.outputs.PYTHON_VER }}/${{ matrix.target }}/VERSIONS | cut -d " " -f 2)
 
         echo "PYTHON_VERSION=${PYTHON_VERSION}" | tee -a ${GITHUB_OUTPUT}
         echo "BZIP2_VERSION=${BZIP2_VERSION}" | tee -a ${GITHUB_OUTPUT}
-        echo "XZ_VERSION=${XZ_VERSION}" | tee -a ${GITHUB_OUTPUT}
-        echo "OPENSSL_VERSION=${OPENSSL_VERSION}" | tee -a ${GITHUB_OUTPUT}
         echo "LIBFFI_VERSION=${LIBFFI_VERSION}" | tee -a ${GITHUB_OUTPUT}
+        echo "MPDECIMAL_VERSION=${MPDECIMAL_VERSION}" | tee -a ${GITHUB_OUTPUT}
+        echo "OPENSSL_VERSION=${OPENSSL_VERSION}" | tee -a ${GITHUB_OUTPUT}
+        echo "XZ_VERSION=${XZ_VERSION}" | tee -a ${GITHUB_OUTPUT}
 
     - name: Upload Build Artifact
       uses: actions/upload-artifact@v4.3.5
@@ -95,8 +97,9 @@ jobs:
 
           Includes:
           * Python ${{ needs.build.outputs.PYTHON_VERSION }}
-          * OpenSSL  ${{ needs.build.outputs.OPENSSL_VERSION }}
           * BZip2 ${{ needs.build.outputs.BZIP2_VERSION }}
+          * libFFI ${{ needs.build.outputs.LIBFFI_VERSION }}
+          * mpdecimal ${{ needs.build.outputs.MPDECIMAL_VERSION }}
+          * OpenSSL  ${{ needs.build.outputs.OPENSSL_VERSION }}
           * XZ ${{ needs.build.outputs.XZ_VERSION }}
-          * LibFFI ${{ needs.build.outputs.LIBFFI_VERSION }}
         artifacts: "dist/*"
diff --git a/Makefile b/Makefile
index 27ec788..3487035 100644
--- a/Makefile
+++ b/Makefile
@@ -13,19 +13,24 @@ BUILD_NUMBER=custom
 
 # Version of packages that will be compiled by this meta-package
 # PYTHON_VERSION is the full version number (e.g., 3.10.0b3)
+# PYTHON_PKG_VERSION is the version number with binary package releases to use
+# for macOS binaries. This will be less than PYTHON_VERSION towards the end
+# of a release cycle, as official binaries won't be published.
 # PYTHON_MICRO_VERSION is the full version number, without any alpha/beta/rc suffix. (e.g., 3.10.0)
 # PYTHON_VER is the major/minor version (e.g., 3.10)
 PYTHON_VERSION=3.12.4
+PYTHON_PKG_VERSION=$(PYTHON_VERSION)
 PYTHON_MICRO_VERSION=$(shell echo $(PYTHON_VERSION) | grep -Eo "\d+\.\d+\.\d+")
+PYTHON_PKG_MICRO_VERSION=$(shell echo $(PYTHON_PKG_VERSION) | grep -Eo "\d+\.\d+\.\d+")
 PYTHON_VER=$(basename $(PYTHON_VERSION))
 
 # The binary releases of dependencies, published at:
 # https://github.com/beeware/cpython-apple-source-deps/releases
 BZIP2_VERSION=1.0.8-1
+LIBFFI_VERSION=3.4.6-1
 MPDECIMAL_VERSION=4.0.0-1
 OPENSSL_VERSION=3.0.14-1
 XZ_VERSION=5.4.7-1
-LIBFFI_VERSION=3.4.6-1
 
 # Supported OS
 OS_LIST=macOS iOS tvOS watchOS
@@ -96,11 +101,11 @@ downloads/Python-$(PYTHON_VERSION).tar.gz:
 	curl $(CURL_FLAGS) -o $@ \
 		https://www.python.org/ftp/python/$(PYTHON_MICRO_VERSION)/Python-$(PYTHON_VERSION).tgz
 
-downloads/python-$(PYTHON_VERSION)-macos11.pkg:
+downloads/python-$(PYTHON_PKG_VERSION)-macos11.pkg:
 	@echo ">>> Download macOS Python package"
 	mkdir -p downloads
 	curl $(CURL_FLAGS) -o $@ \
-		https://www.python.org/ftp/python/$(PYTHON_MICRO_VERSION)/python-$(PYTHON_VERSION)-macos11.pkg
+		https://www.python.org/ftp/python/$(PYTHON_PKG_MICRO_VERSION)/python-$(PYTHON_PKG_VERSION)-macos11.pkg
 
 ###########################################################################
 # Build for specified target (from $(TARGETS-*))
@@ -258,10 +263,10 @@ PYTHON_STDLIB-$(target)=$$(PYTHON_INSTALL-$(target))/lib/python$(PYTHON_VER)
 $$(PYTHON_SRCDIR-$(target))/configure: \
 		downloads/Python-$(PYTHON_VERSION).tar.gz \
 		$$(BZIP2_LIB-$(target)) \
-		$$(XZ_LIB-$(target)) \
-		$$(OPENSSL_SSL_LIB-$(target)) \
+		$$(LIBFFI_LIB-$(target)) \
 		$$(MPDECIMAL_LIB-$(target)) \
-		$$(LIBFFI_LIB-$(target))
+		$$(OPENSSL_SSL_LIB-$(target)) \
+		$$(XZ_LIB-$(target))
 	@echo ">>> Unpack and configure Python for $(target)"
 	mkdir -p $$(PYTHON_SRCDIR-$(target))
 	tar zxf downloads/Python-$(PYTHON_VERSION).tar.gz --strip-components 1 -C $$(PYTHON_SRCDIR-$(target))
@@ -335,14 +340,14 @@ vars-$(target):
 	@echo "SDK_ROOT-$(target): $$(SDK_ROOT-$(target))"
 	@echo "BZIP2_INSTALL-$(target): $$(BZIP2_INSTALL-$(target))"
 	@echo "BZIP2_LIB-$(target): $$(BZIP2_LIB-$(target))"
-	@echo "XZ_INSTALL-$(target): $$(XZ_INSTALL-$(target))"
-	@echo "XZ_LIB-$(target): $$(XZ_LIB-$(target))"
-	@echo "OPENSSL_INSTALL-$(target): $$(OPENSSL_INSTALL-$(target))"
-	@echo "OPENSSL_SSL_LIB-$(target): $$(OPENSSL_SSL_LIB-$(target))"
-	@echo "MPDECIMAL_INSTALL-$(target): $$(MPDECIMAL_INSTALL-$(target))"
-	@echo "MPDECIMAL_LIB-$(target): $$(MPDECIMAL_LIB-$(target))"
 	@echo "LIBFFI_INSTALL-$(target): $$(LIBFFI_INSTALL-$(target))"
 	@echo "LIBFFI_LIB-$(target): $$(LIBFFI_LIB-$(target))"
+	@echo "MPDECIMAL_INSTALL-$(target): $$(MPDECIMAL_INSTALL-$(target))"
+	@echo "MPDECIMAL_LIB-$(target): $$(MPDECIMAL_LIB-$(target))"
+	@echo "OPENSSL_INSTALL-$(target): $$(OPENSSL_INSTALL-$(target))"
+	@echo "OPENSSL_SSL_LIB-$(target): $$(OPENSSL_SSL_LIB-$(target))"
+	@echo "XZ_INSTALL-$(target): $$(XZ_INSTALL-$(target))"
+	@echo "XZ_LIB-$(target): $$(XZ_LIB-$(target))"
 	@echo "PYTHON_SRCDIR-$(target): $$(PYTHON_SRCDIR-$(target))"
 	@echo "PYTHON_INSTALL-$(target): $$(PYTHON_INSTALL-$(target))"
 	@echo "PYTHON_FRAMEWORK-$(target): $$(PYTHON_FRAMEWORK-$(target))"
@@ -521,7 +526,7 @@ ifeq ($(os),macOS)
 PYTHON_FRAMEWORK-$(os)=$$(PYTHON_INSTALL-$(sdk))/Python.framework
 
 $$(PYTHON_XCFRAMEWORK-$(os))/Info.plist: \
-		downloads/python-$(PYTHON_VERSION)-macos11.pkg
+		downloads/python-$(PYTHON_PKG_VERSION)-macos11.pkg
 	@echo ">>> Repackage macOS package as XCFramework"
 
 	# Unpack .pkg file. It turns out .pkg files are readable by tar... although
@@ -529,7 +534,7 @@ $$(PYTHON_XCFRAMEWORK-$(os))/Info.plist: \
 	# is a tarball that contains additional tarballs; the inner tarball has the
 	# "payload" that is the framework.
 	mkdir -p build/macOS/macosx/python-$(PYTHON_VERSION)
-	tar zxf downloads/python-$(PYTHON_VERSION)-macos11.pkg -C build/macOS/macosx/python-$(PYTHON_VERSION)
+	tar zxf downloads/python-$(PYTHON_PKG_VERSION)-macos11.pkg -C build/macOS/macosx/python-$(PYTHON_VERSION)
 
 	# Unpack payload inside .pkg file
 	mkdir -p $$(PYTHON_FRAMEWORK-macosx)
@@ -594,10 +599,10 @@ $$(PYTHON_XCFRAMEWORK-$(os))/Info.plist: \
 	echo "Build: $(BUILD_NUMBER)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 	echo "Min $(os) version: $$(VERSION_MIN-$(os))" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 	echo "---------------------" >> support/$(PYTHON_VER)/$(os)/VERSIONS
-	echo "libFFI: $(LIBFFI_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 	echo "BZip2: $(BZIP2_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
-	echo "OpenSSL: $(OPENSSL_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
+	echo "libFFI: $(LIBFFI_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 	echo "mpdecimal: $(MPDECIMAL_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
+	echo "OpenSSL: $(OPENSSL_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 	echo "XZ: $(XZ_VERSION)" >> support/$(PYTHON_VER)/$(os)/VERSIONS
 
 dist/Python-$(PYTHON_VER)-$(os)-support.$(BUILD_NUMBER).tar.gz: \