diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 2555c28..36f007e 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -27,8 +27,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 02461d2..c470b21 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -82,8 +82,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
@@ -167,6 +167,7 @@ jobs:
           - 16.x
           - 18.0.0
           - 18.x
+          - 20.x
     runs-on: ${{ matrix.platform.os }}
     defaults:
       run:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 172a86e..7f7f93b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,8 +31,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
@@ -109,6 +109,7 @@ jobs:
           - 16.x
           - 18.0.0
           - 18.x
+          - 20.x
     runs-on: ${{ matrix.platform.os }}
     defaults:
       run:
diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index c889883..c144660 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -28,8 +28,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index aac7cb6..63a6169 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -31,8 +31,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6aa4ba4..c81f362 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,8 +44,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
@@ -201,8 +201,8 @@ jobs:
         uses: actions/setup-node@v3
         id: node
         with:
-          node-version: 18.x
-          check-latest: contains('18.x', '.x')
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
 
       # node 10/12/14 ship with npm@6, which is known to fail when updating itself in windows
       - name: Update Windows npm
@@ -425,7 +425,7 @@ jobs:
       - name: Publish
         env:
           PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
-        run: npm publish --provenance
+        run: npm publish --provenance --tag=latest
 
   post-release-integration:
     needs: [ release, release-integration ]
diff --git a/package.json b/package.json
index 8318a3a..ba353de 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,7 @@
   "devDependencies": {
     "@npmcli/arborist": "^6.0.0 || ^6.0.0-pre.0",
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.18.1",
+    "@npmcli/template-oss": "4.19.0",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"
   },
@@ -55,7 +55,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.18.1",
+    "version": "4.19.0",
     "publish": true
   }
 }