diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f83c23..fba59b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,11 +22,11 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 20.x
           cache: npm
       - run: npm ci
       - run: npm run build-checkout
-      - run: npm run build
+      - run: NODE_OPTIONS=--openssl-legacy-provider npm run build
       - run: npm run format-check
       - run: npm run lint
       - run: npm run test
diff --git a/.github/workflows/update-major-version.yml b/.github/workflows/update-major-version.yml
new file mode 100644
index 0000000..6fcdb91
--- /dev/null
+++ b/.github/workflows/update-major-version.yml
@@ -0,0 +1,31 @@
+name: Update Major Version
+run-name: Update ${{ github.event.inputs.main_version }} to ${{ github.event.inputs.target }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: The target tag or reference
+        required: true
+      main_version:
+        type: choice
+        description: The major version tag to update
+        options:
+          - v3
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        token: ${{ secrets.ACTIONS_BOT_TOKEN }}
+        fetch-depth: 0
+    - name: Git config
+      run: |
+        git config user.name actions-bot
+        git config user.email actions-bot@users.noreply.github.com
+    - name: Tag new target
+      run: git tag -f ${{ github.event.inputs.main_version }} ${{ github.event.inputs.target }}
+    - name: Push new tag
+      run: git push origin ${{ github.event.inputs.main_version }} --force
diff --git a/README.md b/README.md
index 15bcdd5..5160ad0 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ The default behaviour of the action with no configured inputs is to check the cu
 Pull requests from forks are rebaseable only if they [allow edits from maintainers](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork).
 
 ```yml
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
 ```
 
 ### Periodically rebase all pull requests
@@ -26,7 +26,7 @@ jobs:
   rebase:
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
 ```
 
 ### Rebase all pull requests on push to the base branch
@@ -40,7 +40,7 @@ jobs:
   rebase:
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
         with:
           base: main
 ```
@@ -48,7 +48,7 @@ jobs:
 ### Exclude pull requests with specific labels
 
 ```yml
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
         with:
           exclude-labels: |
             no-rebase
@@ -58,7 +58,7 @@ jobs:
 ### Exclude pull request forks with head filter
 
 ```yml
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
         with:
           head: 'my-org:*'
 ```
@@ -107,7 +107,7 @@ jobs:
   rebase:
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
         id: rebase
         with:
           head: ${{ github.event.client_payload.pull_request.head.label }}
@@ -140,7 +140,7 @@ jobs:
         repo: ['my-org/repo1', 'my-org/repo2', 'my-org/repo3']
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/rebase@v2
+      - uses: peter-evans/rebase@v3
         with:
           token: ${{ secrets.PAT }}
           repository: ${{ matrix.repo }}
diff --git a/action.yml b/action.yml
index f60ed66..0513fed 100644
--- a/action.yml
+++ b/action.yml
@@ -25,7 +25,7 @@ inputs:
     description: 'Exclude draft pull requests'
     default: false
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'
 branding:
   icon: 'git-pull-request'
diff --git a/package-lock.json b/package-lock.json
index d3814de..68b9cc5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "rebase",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "rebase",
-      "version": "2.0.0",
+      "version": "3.0.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
diff --git a/package.json b/package.json
index 257183d..1cd1481 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rebase",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "private": true,
   "description": "Rebase pull requests in a repository",
   "main": "lib/main.js",