diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..2c7d170839
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 617ce89eba..d8c33622f7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,5 +1,5 @@
 name: build
-on: [ push, pull_request ]
+on: [ push, pull_request, release ]
 
 env:
   ORG_GRADLE_PROJECT_checksumFailOn: build_finish
@@ -31,6 +31,12 @@ jobs:
           restore-keys: ${{ runner.os }}-gradle
       - name: Run tests
         run: ./.github/scripts/test.sh
+      - name: Import GPG key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@v3
+        with:
+          gpg-private-key: ${{ secrets.OSSRH_GPG_SECRET_KEY }}
+          passphrase: ${{ secrets.OSSRH_GPG_SECRET_KEY_PASSWORD }}
       - name: Publish Coverage
         if: >
           matrix.java == env.MIN_JVM
@@ -56,4 +62,13 @@ jobs:
         env:
           NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
           NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
-        run: ./gradlew publish
+        run: ./gradlew publishToSonatype
+      - name: Releasing
+        if: >
+          matrix.java == env.MIN_JVM
+          && github.event_name == 'release'
+          && github.event.action == 'created'
+        env:
+          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+        run: ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository -Prelease
diff --git a/build.gradle b/build.gradle
index 3d54c0ad37..ad3d08bfb6 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,5 +1,6 @@
 import net.ltgt.gradle.errorprone.CheckSeverity
 
+apply plugin: 'io.github.gradle-nexus.publish-plugin'
 apply plugin: 'com.github.mjdetullio.gradle.coverity'
 apply plugin: 'com.github.ben-manes.versions'
 apply plugin: 'com.github.kt3k.coveralls'
@@ -40,8 +41,8 @@ allprojects {
   group = 'com.github.ben-manes.caffeine'
   version.with {
     major = 2 // incompatible API changes
-    minor = 8 // backwards-compatible additions
-    patch = 9 // backwards-compatible bug fixes
+    minor = 9 // backwards-compatible additions
+    patch = 0 // backwards-compatible bug fixes
     releaseBuild = rootProject.hasProperty('release')
   }
 }
@@ -105,6 +106,15 @@ subprojects {
   }
 }
 
+nexusPublishing {
+  repositories {
+    sonatype {
+      username = project.properties['nexusUsername'] ?: System.env.'NEXUS_USERNAME'
+      password = project.properties['nexusPassword'] ?: System.env.'NEXUS_PASSWORD'
+    }
+  }
+}
+
 // Only report code coverage for projects that are distributed
 def publishedProjects = subprojects.findAll { it.path != ':simulator' }
 
diff --git a/checksum.xml b/checksum.xml
index c14f2eecd8..bb78ddb11f 100644
--- a/checksum.xml
+++ b/checksum.xml
@@ -363,6 +363,9 @@
     <dependency group='io.ehdev' module='gradle-semantic-versioning' version='1.1.0'>
       <sha512>1A47AAF2442159C1CBD22521F31C74B4C71C4168AF5B22D04B4691FDD286E90F02B2792DEDAD3EEEC12B5034ADA1A9EE751C975B5A169AE0B33EE800A8D96E7F</sha512>
     </dependency>
+    <dependency group='io.github.gradle-nexus' module='publish-plugin' version='1.0.0'>
+      <sha512>B57469B9FA2C5D598688FF9C6A3B3283496921B91E269EA6D5A1DA6511125BD2545E2CFA8D3736739787B0BACF69C0AF5C5ECDEA474CB9FD56C96495E654682B</sha512>
+    </dependency>
     <dependency group='javax.inject' module='javax.inject' version='1'>
       <sha512>E126B7CCF3E42FD1984A0BEEF1004A7269A337C202E59E04E8E2AF714280D2F2D8D2BA5E6F59481B8DCD34AAF35C966A688D0B48EC7E96F102C274DC0D3B381E</sha512>
     </dependency>
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
index a0a6ecdafa..a6cbd6aeb2 100644
--- a/gradle/dependencies.gradle
+++ b/gradle/dependencies.gradle
@@ -91,6 +91,7 @@ ext {
     jandex: '0.9.0',
     jmh: '0.5.3',
     jmhReport: '0.9.0',
+    nexusPublish: '1.0.0',
     nullaway: '1.0.2',
     pmd: '6.31.0',
     semanticVersioning: '1.1.0',
@@ -200,6 +201,7 @@ ext {
       "org.openjdk.jmh:jmh-core:${versions.jmh}",
     ],
     jmhReport: "gradle.plugin.io.morethan.jmhreport:gradle-jmh-report:${pluginVersions.jmhReport}",
+    nexusPublish: "io.github.gradle-nexus:publish-plugin:${pluginVersions.nexusPublish}",
     nullaway: "net.ltgt.gradle:gradle-nullaway-plugin:${pluginVersions.nullaway}",
     semanticVersioning: "io.ehdev:gradle-semantic-versioning:${pluginVersions.semanticVersioning}",
     shadow: "com.github.jengelman.gradle.plugins:shadow:${pluginVersions.shadow}",
diff --git a/gradle/publish.gradle b/gradle/publish.gradle
index 540d453b61..aa4efc9ec0 100644
--- a/gradle/publish.gradle
+++ b/gradle/publish.gradle
@@ -59,18 +59,6 @@ publishing {
           }
         }
       }
-      repositories {
-        maven {
-          def releasesUrl = 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
-          def snapshotsUrl = 'https://oss.sonatype.org/content/repositories/snapshots/'
-          url = project.version.releaseBuild ? releasesUrl : snapshotsUrl
-
-          credentials {
-            username = project.properties['nexusUsername'] ?: System.env.'NEXUS_USERNAME'
-            password = project.properties['nexusPassword'] ?: System.env.'NEXUS_PASSWORD'
-          }
-        }
-      }
     }
   }
 }
@@ -88,7 +76,3 @@ javadoc {
     options.addBooleanOption('html5', true)
   }
 }
-
-if (JavaVersion.current().isJava9Compatible()) {
-  [publish, publishMavenJavaPublicationToMavenRepository]*.enabled = false
-}