diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bbabcc3..e65602c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,8 +1,5 @@
 name: CI
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 on:
   push:
     branches: [ main ]
@@ -15,14 +12,21 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
-      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          # 8.0.x supplies the runtime the net8.0 test run executes on; the
+          # build itself uses the newest installed SDK (10.0.x).
+          dotnet-version: |
+            8.0.x
+            10.0.x
 
       - name: Restore
         run: dotnet restore
@@ -37,7 +41,7 @@ jobs:
         run: dotnet pack --configuration Release --no-build --output ./artifacts
 
       - name: Upload package artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: nuget-package
           # Capture both .nupkg and .snupkg so the publish job's
@@ -51,19 +55,20 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
 
     permissions:
+      contents: read    # actions/checkout — an explicit `permissions` block sets unlisted scopes to `none`
       id-token: write   # required for NuGet trusted publishing (OIDC token issuance)
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
       - name: Download artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: nuget-package
           path: ./artifacts
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c63c00..e122e8a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased]
+
+### Changed
+
+- **Test suite migrated to xUnit.net v3 (`xunit.v3` 4.0.0)** from `xunit` 2.9.3.
+  Contributor-facing only — no library code, public API, or shipped package
+  contents changed. v3 test projects are self-executing console apps and run on
+  [Microsoft.Testing.Platform](https://learn.microsoft.com/dotnet/core/testing/microsoft-testing-platform-intro)
+  rather than VSTest, so a root `global.json` now opts `dotnet test` into the
+  MTP runner. `Microsoft.NET.Test.Sdk` and `xunit.runner.visualstudio` are no
+  longer needed and were dropped.
+
+- **Tests now run against both shipped TFMs.** The test project multi-targets
+  `net8.0;net10.0`, mirroring the library, so `lib/net8.0` is actually executed
+  against its own dependency graph instead of only being compiled. Previously
+  the suite ran on `net10.0` only. Running the full suite locally now requires
+  the .NET 8 runtime alongside the .NET 10 SDK.
+
+### Removed
+
+- **`Microsoft.SourceLink.GitHub` package reference.** The .NET SDK has bundled
+  SourceLink since .NET 8; the explicit reference was redundant. Verified
+  byte-identical `.nuspec` and `.snupkg` output either way — consumers still get
+  repository metadata and step-through sources.
+
+### Fixed
+
+- **`PackageOutputPath` no longer breaks non-Windows builds.** The hardcoded
+  `C:\nuget-local\` local dev feed is now guarded to Windows; previously every
+  `dotnet build` on Linux/macOS and in CI created a literal `C:\nuget-local\`
+  directory under `src/`.
+- **CI publish job could not check out the repo.** Its `permissions` block listed
+  only `id-token: write`, and GitHub sets every unlisted scope to `none`, leaving
+  `actions/checkout` without `contents: read`.
+
+---
+
 ## [0.3.0] — 2026-07-24
 
 ### Changed
@@ -82,6 +119,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   interpolation, colour validation, tagline strategies, renderer output,
   and the quote pool).
 
+[Unreleased]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Splash/compare/v0.3.0...HEAD
 [0.3.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Splash/releases/tag/v0.3.0
 [0.2.0]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Splash/releases/tag/v0.2.0
 [0.1.2]: https://github.com/StuartMeeks/NextIteration.SpectreConsole.Splash/releases/tag/v0.1.2
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 1bafd33..8d91e1b 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -7,13 +7,10 @@
     <PackageVersion Include="Figgle" Version="0.6.6" />
     <PackageVersion Include="Figgle.Fonts" Version="0.6.6" />
     <PackageVersion Include="Spectre.Console" Version="0.57.2" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
   </ItemGroup>
 
   <ItemGroup Label="Test">
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="Spectre.Console.Testing" Version="0.57.2" />
-    <PackageVersion Include="xunit" Version="2.9.3" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="xunit.v3" Version="4.0.0" />
   </ItemGroup>
 </Project>
diff --git a/global.json b/global.json
new file mode 100644
index 0000000..3140116
--- /dev/null
+++ b/global.json
@@ -0,0 +1,5 @@
+{
+  "test": {
+    "runner": "Microsoft.Testing.Platform"
+  }
+}
diff --git a/src/NextIteration.SpectreConsole.Splash/NextIteration.SpectreConsole.Splash.csproj b/src/NextIteration.SpectreConsole.Splash/NextIteration.SpectreConsole.Splash.csproj
index b846efa..153949d 100644
--- a/src/NextIteration.SpectreConsole.Splash/NextIteration.SpectreConsole.Splash.csproj
+++ b/src/NextIteration.SpectreConsole.Splash/NextIteration.SpectreConsole.Splash.csproj
@@ -3,7 +3,6 @@
 	<PropertyGroup>
 		<TargetFrameworks>net8.0;net10.0</TargetFrameworks>
 		<ImplicitUsings>enable</ImplicitUsings>
-		<Nullable>enable</Nullable>
 		<SatelliteResourceLanguages>en</SatelliteResourceLanguages>
 		<GenerateDocumentationFile>true</GenerateDocumentationFile>
 		<AnalysisLevel>latest</AnalysisLevel>
@@ -12,10 +11,11 @@
 	<PropertyGroup>
 		<PackageId>NextIteration.SpectreConsole.Splash</PackageId>
 		<Version>0.3.0</Version>
-		<Authors>Stuart Meeks</Authors>
 		<Description>Configurable Figgle + Spectre.Console splash screen for .NET CLIs — gradient palette, pluggable tagline strategy, single-markup-call render path.</Description>
 		<GeneratePackageOnBuild>true</GeneratePackageOnBuild>
-		<PackageOutputPath>C:\nuget-local\</PackageOutputPath>
+		<!-- Local dev feed, Windows only. Unguarded this created a literal
+		     `C:\nuget-local\` directory on Linux/macOS and in CI. -->
+		<PackageOutputPath Condition="$([MSBuild]::IsOSPlatform('Windows'))">C:\nuget-local\</PackageOutputPath>
 		<IncludeBuildOutput>true</IncludeBuildOutput>
 		<PackageLicenseExpression>MIT</PackageLicenseExpression>
 		<PackageReadmeFile>README.md</PackageReadmeFile>
@@ -42,7 +42,6 @@
 		<PackageReference Include="Figgle" />
 		<PackageReference Include="Figgle.Fonts" />
 		<PackageReference Include="Spectre.Console" />
-		<PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" />
 		<None Include="..\..\README.md" Pack="true" PackagePath="\" />
 		<None Include="icon.png" Pack="true" PackagePath="" />
 	</ItemGroup>
diff --git a/tests/NextIteration.SpectreConsole.Splash.Tests/GradientTests.cs b/tests/NextIteration.SpectreConsole.Splash.Tests/GradientTests.cs
index 60ea4be..c66ec06 100644
--- a/tests/NextIteration.SpectreConsole.Splash.Tests/GradientTests.cs
+++ b/tests/NextIteration.SpectreConsole.Splash.Tests/GradientTests.cs
@@ -78,10 +78,10 @@ public void Width_one_returns_first_stop()
         {
             var result = Gradient.Generate(["#123456", "#FFFFFF"], 1);
 
-            Assert.Single(result);
-            Assert.Equal(0x12, result[0].R);
-            Assert.Equal(0x34, result[0].G);
-            Assert.Equal(0x56, result[0].B);
+            var only = Assert.Single(result);
+            Assert.Equal(0x12, only.R);
+            Assert.Equal(0x34, only.G);
+            Assert.Equal(0x56, only.B);
         }
 
         [Fact]
diff --git a/tests/NextIteration.SpectreConsole.Splash.Tests/NextIteration.SpectreConsole.Splash.Tests.csproj b/tests/NextIteration.SpectreConsole.Splash.Tests/NextIteration.SpectreConsole.Splash.Tests.csproj
index e56d1fb..1447a3d 100644
--- a/tests/NextIteration.SpectreConsole.Splash.Tests/NextIteration.SpectreConsole.Splash.Tests.csproj
+++ b/tests/NextIteration.SpectreConsole.Splash.Tests/NextIteration.SpectreConsole.Splash.Tests.csproj
@@ -1,9 +1,12 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
 	<PropertyGroup>
-		<TargetFramework>net10.0</TargetFramework>
+		<!-- Mirrors the library's TFMs so both shipped `lib/` assets are
+		     actually executed, each against its own dependency graph. -->
+		<TargetFrameworks>net8.0;net10.0</TargetFrameworks>
+		<!-- xUnit.net v3 test projects are self-executing console apps. -->
+		<OutputType>Exe</OutputType>
 		<ImplicitUsings>enable</ImplicitUsings>
-		<Nullable>enable</Nullable>
 		<IsPackable>false</IsPackable>
 		<IsTestProject>true</IsTestProject>
 		<!-- Underscore naming (`Thing_does_thing`) is idiomatic for xUnit test methods. -->
@@ -11,10 +14,8 @@
 	</PropertyGroup>
 
 	<ItemGroup>
-		<PackageReference Include="Microsoft.NET.Test.Sdk" />
 		<PackageReference Include="Spectre.Console.Testing" />
-		<PackageReference Include="xunit" />
-		<PackageReference Include="xunit.runner.visualstudio" />
+		<PackageReference Include="xunit.v3" />
 	</ItemGroup>
 
 	<ItemGroup>