diff --git a/.gitattributes b/.gitattributes
index c3edfc2f..3b82c0a8 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -9,6 +9,9 @@
 /.github/workflows/build.yml linguist-generated
 /.github/workflows/pull-request-lint.yml linguist-generated
 /.github/workflows/release-kubectl-v20.yml linguist-generated
+/.github/workflows/retry-automerge.yml linguist-generated
+/.github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml linguist-generated
+/.github/workflows/upgrade-dev-deps-kubectl-v20-main.yml linguist-generated
 /.github/workflows/upgrade-kubectl-v20-main.yml linguist-generated
 /.gitignore linguist-generated
 /.mergify.yml linguist-generated
diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 91d51bb4..d796c83c 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
-    if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && (github.event.pull_request.user.login == 'aws-cdk-automation' || github.event.pull_request.user.login == 'mergify[bot]')
+    if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && (github.event.pull_request.user.login == 'aws-cdk-automation' || github.event.pull_request.user.login == 'dependabot[bot]')
     steps:
       - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363
         with:
diff --git a/.github/workflows/release-kubectl-v20.yml b/.github/workflows/release-kubectl-v20.yml
index 93af9cc6..5a3d3ddc 100644
--- a/.github/workflows/release-kubectl-v20.yml
+++ b/.github/workflows/release-kubectl-v20.yml
@@ -71,6 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-node@v5
@@ -95,6 +96,7 @@ jobs:
     permissions:
       id-token: write
       contents: read
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-node@v5
@@ -127,7 +129,7 @@ jobs:
           NPM_DIST_TAG: latest
           NPM_REGISTRY: registry.npmjs.org
           NPM_CONFIG_PROVENANCE: "true"
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TRUSTED_PUBLISHER: "true"
         run: npx -p publib@latest publib-npm
   release_maven:
     name: Publish to Maven Central
@@ -135,6 +137,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-java@v5
@@ -181,6 +184,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-node@v5
@@ -213,8 +218,7 @@ jobs:
         run: mv .repo/dist dist
       - name: Release
         env:
-          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
+          PYPI_TRUSTED_PUBLISHER: "true"
         run: npx -p publib@latest publib-pypi
   release_nuget:
     name: Publish to NuGet Gallery
@@ -222,6 +226,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-node@v5
@@ -262,6 +267,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    environment: release
     if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
     steps:
       - uses: actions/setup-node@v5
diff --git a/.github/workflows/retry-automerge.yml b/.github/workflows/retry-automerge.yml
new file mode 100644
index 00000000..47c74a79
--- /dev/null
+++ b/.github/workflows/retry-automerge.yml
@@ -0,0 +1,18 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+name: retry-automerge
+on:
+  pull_request:
+    types:
+      - auto_merge_disabled
+jobs:
+  retry-automerge:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Print github context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+      - name: Print github event file
+        run: jq . "$GITHUB_EVENT_PATH"
diff --git a/.github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml b/.github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml
new file mode 100644
index 00000000..41044b48
--- /dev/null
+++ b/.github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml
@@ -0,0 +1,90 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+name: upgrade-cdklabs-projen-project-types-kubectl-v20-main
+on:
+  workflow_dispatch: {}
+jobs:
+  upgrade:
+    name: Upgrade
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      patch_created: ${{ steps.create_patch.outputs.patch_created }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: kubectl-v20/main
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+      - name: Install dependencies
+        run: yarn install --check-files --frozen-lockfile
+      - name: Upgrade dependencies
+        run: npx projen upgrade-cdklabs-projen-project-types
+      - name: Find mutations
+        id: create_patch
+        run: |-
+          git add .
+          git diff --staged --patch --exit-code > repo.patch || echo "patch_created=true" >> $GITHUB_OUTPUT
+        shell: bash
+        working-directory: ./
+      - name: Upload patch
+        if: steps.create_patch.outputs.patch_created
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: repo.patch
+          path: repo.patch
+          overwrite: true
+  pr:
+    name: Create Pull Request
+    needs: upgrade
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    if: ${{ needs.upgrade.outputs.patch_created }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: kubectl-v20/main
+      - name: Download patch
+        uses: actions/download-artifact@v5
+        with:
+          name: repo.patch
+          path: ${{ runner.temp }}
+      - name: Apply patch
+        run: '[ -s ${{ runner.temp }}/repo.patch ] && git apply ${{ runner.temp }}/repo.patch || echo "Empty patch. Skipping."'
+      - name: Set git identity
+        run: |-
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Create Pull Request
+        id: create-pr
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
+          commit-message: |-
+            chore(deps): upgrade cdklabs-projen-project-types
+
+            Upgrades project dependencies. See details in [workflow run].
+
+            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            ------
+
+            *Automatically created by projen via the "upgrade-cdklabs-projen-project-types-kubectl-v20-main" workflow*
+          branch: github-actions/upgrade-cdklabs-projen-project-types-kubectl-v20-main
+          title: "chore(deps): upgrade cdklabs-projen-project-types"
+          labels: auto-approve
+          body: |-
+            Upgrades project dependencies. See details in [workflow run].
+
+            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            ------
+
+            *Automatically created by projen via the "upgrade-cdklabs-projen-project-types-kubectl-v20-main" workflow*
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          signoff: true
diff --git a/.github/workflows/upgrade-dev-deps-kubectl-v20-main.yml b/.github/workflows/upgrade-dev-deps-kubectl-v20-main.yml
new file mode 100644
index 00000000..dfd388fb
--- /dev/null
+++ b/.github/workflows/upgrade-dev-deps-kubectl-v20-main.yml
@@ -0,0 +1,94 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+name: upgrade-dev-deps-kubectl-v20-main
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: 0 22 * * 1
+jobs:
+  upgrade:
+    name: Upgrade
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      patch_created: ${{ steps.create_patch.outputs.patch_created }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: kubectl-v20/main
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: lts/*
+      - name: Install dependencies
+        run: yarn install --check-files --frozen-lockfile
+      - name: Upgrade dependencies
+        run: npx projen upgrade-dev-deps
+      - name: Find mutations
+        id: create_patch
+        run: |-
+          git add .
+          git diff --staged --patch --exit-code > repo.patch || echo "patch_created=true" >> $GITHUB_OUTPUT
+        shell: bash
+        working-directory: ./
+      - name: Upload patch
+        if: steps.create_patch.outputs.patch_created
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: repo.patch
+          path: repo.patch
+          overwrite: true
+  pr:
+    name: Create Pull Request
+    needs: upgrade
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    if: ${{ needs.upgrade.outputs.patch_created }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: kubectl-v20/main
+      - name: Download patch
+        uses: actions/download-artifact@v5
+        with:
+          name: repo.patch
+          path: ${{ runner.temp }}
+      - name: Apply patch
+        run: '[ -s ${{ runner.temp }}/repo.patch ] && git apply ${{ runner.temp }}/repo.patch || echo "Empty patch. Skipping."'
+      - name: Set git identity
+        run: |-
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+      - name: Create Pull Request
+        id: create-pr
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
+          commit-message: |-
+            chore(deps): upgrade dev dependencies
+
+            Upgrades project dependencies. See details in [workflow run].
+
+            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            ------
+
+            *Automatically created by projen via the "upgrade-dev-deps-kubectl-v20-main" workflow*
+          branch: github-actions/upgrade-dev-deps-kubectl-v20-main
+          title: "chore(deps): upgrade dev dependencies"
+          labels: auto-approve
+          body: |-
+            Upgrades project dependencies. See details in [workflow run].
+
+            [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            ------
+
+            *Automatically created by projen via the "upgrade-dev-deps-kubectl-v20-main" workflow*
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+          signoff: true
diff --git a/.github/workflows/upgrade-kubectl-v20-main.yml b/.github/workflows/upgrade-kubectl-v20-main.yml
index 017e168b..49e842de 100644
--- a/.github/workflows/upgrade-kubectl-v20-main.yml
+++ b/.github/workflows/upgrade-kubectl-v20-main.yml
@@ -4,7 +4,7 @@ name: upgrade-kubectl-v20-main
 on:
   workflow_dispatch: {}
   schedule:
-    - cron: 0 0 * * *
+    - cron: 0 18 * * 1
 jobs:
   upgrade:
     name: Upgrade
@@ -69,7 +69,7 @@ jobs:
         with:
           token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
           commit-message: |-
-            chore(deps): upgrade dependencies
+            fix(deps): upgrade dependencies
 
             Upgrades project dependencies. See details in [workflow run].
 
@@ -79,7 +79,7 @@ jobs:
 
             *Automatically created by projen via the "upgrade-kubectl-v20-main" workflow*
           branch: github-actions/upgrade-kubectl-v20-main
-          title: "chore(deps): upgrade dependencies"
+          title: "fix(deps): upgrade dependencies"
           labels: auto-approve
           body: |-
             Upgrades project dependencies. See details in [workflow run].
diff --git a/.gitignore b/.gitignore
index b5f19f0e..e2bf2201 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,7 +39,6 @@ junit.xml
 /dist/version.txt
 !/.github/workflows/release-kubectl-v20.yml
 !/.mergify.yml
-!/.github/workflows/upgrade-kubectl-v20-main.yml
 !/.github/pull_request_template.md
 !/test/
 !/tsconfig.dev.json
@@ -59,4 +58,10 @@ test/kubectl-asset.integ.snapshot/manifest.json
 test/kubectl-asset.integ.snapshot/**/manifest.json
 test/kubectl-asset.integ.snapshot/tree.json
 test/kubectl-asset.integ.snapshot/**/tree.json
+.jsii.tabl.json
+!/rosetta/default.ts-fixture
+!/.github/workflows/retry-automerge.yml
+!/.github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml
+!/.github/workflows/upgrade-kubectl-v20-main.yml
+!/.github/workflows/upgrade-dev-deps-kubectl-v20-main.yml
 !/.projenrc.ts
diff --git a/.projen/deps.json b/.projen/deps.json
index e3bdcfea..9a95faca 100644
--- a/.projen/deps.json
+++ b/.projen/deps.json
@@ -11,7 +11,7 @@
     },
     {
       "name": "@types/node",
-      "version": "ts5.5",
+      "version": "^18",
       "type": "build"
     },
     {
@@ -29,6 +29,10 @@
       "version": "^2",
       "type": "build"
     },
+    {
+      "name": "cdklabs-projen-project-types",
+      "type": "build"
+    },
     {
       "name": "commit-and-tag-version",
       "version": "^12",
@@ -71,7 +75,6 @@
     },
     {
       "name": "jsii-rosetta",
-      "version": "5.5.x",
       "type": "build"
     },
     {
@@ -96,6 +99,16 @@
       "version": "5.5.x",
       "type": "build"
     },
+    {
+      "name": "@aws-cdk/integ-runner",
+      "version": "latest",
+      "type": "devenv"
+    },
+    {
+      "name": "@aws-cdk/integ-tests-alpha",
+      "version": "latest",
+      "type": "devenv"
+    },
     {
       "name": "aws-cdk-lib",
       "version": "^2.0.0",
diff --git a/.projen/files.json b/.projen/files.json
index 8570edc6..d2dfb5b6 100644
--- a/.projen/files.json
+++ b/.projen/files.json
@@ -7,6 +7,9 @@
     ".github/workflows/build.yml",
     ".github/workflows/pull-request-lint.yml",
     ".github/workflows/release-kubectl-v20.yml",
+    ".github/workflows/retry-automerge.yml",
+    ".github/workflows/upgrade-cdklabs-projen-project-types-kubectl-v20-main.yml",
+    ".github/workflows/upgrade-dev-deps-kubectl-v20-main.yml",
     ".github/workflows/upgrade-kubectl-v20-main.yml",
     ".gitignore",
     ".mergify.yml",
diff --git a/.projen/tasks.json b/.projen/tasks.json
index 3fb1f51c..e7507066 100644
--- a/.projen/tasks.json
+++ b/.projen/tasks.json
@@ -155,6 +155,16 @@
         }
       ]
     },
+    "integ": {
+      "name": "integ",
+      "description": "Run integration snapshot tests",
+      "steps": [
+        {
+          "exec": "yarn integ-runner --language typescript",
+          "receiveArgs": true
+        }
+      ]
+    },
     "integ:kubectl-asset:assert": {
       "name": "integ:kubectl-asset:assert",
       "description": "assert the snapshot of integration test 'kubectl-asset'",
@@ -227,6 +237,16 @@
         }
       ]
     },
+    "integ:update": {
+      "name": "integ:update",
+      "description": "Run and update integration snapshot tests",
+      "steps": [
+        {
+          "exec": "yarn integ-runner --language typescript --update-on-failed",
+          "receiveArgs": true
+        }
+      ]
+    },
     "package": {
       "name": "package",
       "description": "Creates the distribution package",
@@ -355,6 +375,15 @@
         }
       ]
     },
+    "rosetta:extract": {
+      "name": "rosetta:extract",
+      "description": "Test rosetta extract",
+      "steps": [
+        {
+          "exec": "yarn --silent jsii-rosetta extract --strict"
+        }
+      ]
+    },
     "test": {
       "name": "test",
       "description": "Run tests",
@@ -368,6 +397,9 @@
         },
         {
           "spawn": "integ:kubectl-asset:assert"
+        },
+        {
+          "spawn": "integ"
         }
       ]
     },
@@ -406,13 +438,49 @@
       },
       "steps": [
         {
-          "exec": "npx npm-check-updates@18 --upgrade --target=minor --peer --no-deprecated --dep=dev,peer,prod,optional --filter=@types/jest,eslint-import-resolver-typescript,eslint-plugin-import,jest,jsii-diff,jsii-pacmak,projen,ts-jest,ts-node"
+          "exec": "echo No dependencies to upgrade."
+        }
+      ]
+    },
+    "upgrade-cdklabs-projen-project-types": {
+      "name": "upgrade-cdklabs-projen-project-types",
+      "description": "upgrade cdklabs-projen-project-types",
+      "env": {
+        "CI": "0"
+      },
+      "steps": [
+        {
+          "exec": "npx npm-check-updates@18 --upgrade --target=latest --peer --no-deprecated --dep=dev,peer,prod,optional --filter=cdklabs-projen-project-types,projen"
+        },
+        {
+          "exec": "yarn install --check-files"
+        },
+        {
+          "exec": "yarn upgrade cdklabs-projen-project-types projen"
+        },
+        {
+          "exec": "npx projen"
+        },
+        {
+          "spawn": "post-upgrade"
+        }
+      ]
+    },
+    "upgrade-dev-deps": {
+      "name": "upgrade-dev-deps",
+      "description": "upgrade dev dependencies",
+      "env": {
+        "CI": "0"
+      },
+      "steps": [
+        {
+          "exec": "npx npm-check-updates@18 --upgrade --target=minor --peer --no-deprecated --dep=dev --filter=@types/jest,eslint-import-resolver-typescript,eslint-plugin-import,jest,jsii-diff,jsii-pacmak,jsii-rosetta,ts-jest,ts-node"
         },
         {
           "exec": "yarn install --check-files"
         },
         {
-          "exec": "yarn upgrade @stylistic/eslint-plugin @types/jest @types/node @typescript-eslint/eslint-plugin @typescript-eslint/parser aws-cdk commit-and-tag-version eslint-import-resolver-typescript eslint-plugin-import eslint jest jest-junit jsii-diff jsii-docgen jsii-pacmak jsii-rosetta jsii projen ts-jest ts-node typescript aws-cdk-lib constructs"
+          "exec": "yarn upgrade @stylistic/eslint-plugin @types/jest @types/node @typescript-eslint/eslint-plugin @typescript-eslint/parser aws-cdk commit-and-tag-version eslint-import-resolver-typescript eslint-plugin-import eslint jest jest-junit jsii-diff jsii-docgen jsii-pacmak jsii-rosetta jsii ts-jest ts-node typescript @aws-cdk/integ-runner @aws-cdk/integ-tests-alpha aws-cdk-lib constructs"
         },
         {
           "exec": "npx projen"
diff --git a/.projenrc.ts b/.projenrc.ts
index af149f6a..d10b72f4 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -1,26 +1,31 @@
-import { awscdk, DependencyType, javascript, ReleasableCommits } from 'projen';
+import { CdklabsConstructLibrary } from 'cdklabs-projen-project-types';
+import { DependencyType, javascript, ReleasableCommits } from 'projen';
 
 // the version of k8s this branch supports
 const SPEC_VERSION = '20';
 const releaseWorkflowName = `release-kubectl-v${SPEC_VERSION}`;
 const defaultReleaseBranchName = `kubectl-v${SPEC_VERSION}/main`;
 
-const project = new awscdk.AwsCdkConstructLibrary({
+const project = new CdklabsConstructLibrary({
   projenrcTs: true,
   author: 'Amazon Web Services, Inc.',
   authorAddress: 'aws-cdk-dev@amazon.com',
   cdkVersion: '2.0.0',
   name: `@aws-cdk/asset-kubectl-v${SPEC_VERSION}`,
+  packageName: `@aws-cdk/asset-kubectl-v${SPEC_VERSION}`,
   description: `A Lambda Layer that contains kubectl v1.${SPEC_VERSION}`,
   repositoryUrl: 'https://github.com/cdklabs/awscdk-asset-kubectl.git',
   homepage: 'https://github.com/cdklabs/awscdk-asset-kubectl#readme',
+  private: false,
+  setNodeEngineVersion: false,
+  npmAccess: javascript.NpmAccess.PUBLIC,
+  stability: 'stable',
   autoApproveOptions: {
     allowedUsernames: ['aws-cdk-automation', 'mergify[bot]'],
     secret: 'GITHUB_TOKEN',
   },
   autoApproveUpgrades: true,
   majorVersion: 2,
-  npmAccess: javascript.NpmAccess.PUBLIC,
   releaseTagPrefix: `kubectl-v${SPEC_VERSION}`,
   releaseWorkflowName: releaseWorkflowName,
   // If we don't do this we release the devDependency updates that happen every day, which blows out
@@ -41,6 +46,7 @@ const project = new awscdk.AwsCdkConstructLibrary({
   publishToNuget: {
     dotNetNamespace: `Amazon.CDK.Asset.KubectlV${SPEC_VERSION}`,
     packageId: `Amazon.CDK.Asset.KubectlV${SPEC_VERSION}`,
+    trustedPublishing: false,
   },
   publishToGo: {
     moduleName: 'github.com/cdklabs/awscdk-asset-kubectl-go',
@@ -53,12 +59,19 @@ const project = new awscdk.AwsCdkConstructLibrary({
 });
 
 // We only need aws-cdk-lib and constructs for testing. Neither library is used
-// in the public API.
+// in the public API. Remove peer deps and use DEVENV with ranges so that:
+// 1. jsii 5.5.x doesn't try to load the aws-cdk-lib assembly (which requires newer jsii)
+// 2. Tests can use newer CDK features (e.g. Runtime.PYTHON_3_10)
 project.deps.removeDependency('constructs', DependencyType.PEER);
 project.deps.addDependency('constructs@^10.0.5', DependencyType.DEVENV);
 project.deps.removeDependency('aws-cdk-lib', DependencyType.PEER);
 project.deps.addDependency('aws-cdk-lib@^2.0.0', DependencyType.DEVENV);
 
+// CdklabsConstructLibrary adds rosetta:extract to post-compile by default,
+// but without peer deps in the jsii assembly rosetta can't resolve types.
+// The original AwsCdkConstructLibrary config did not run rosetta, so remove it.
+project.postCompileTask.removeStep(1);
+
 project.preCompileTask.exec('layer/build.sh');
 
 project.synth();
diff --git a/package.json b/package.json
index e2d38aeb..110483a1 100644
--- a/package.json
+++ b/package.json
@@ -15,12 +15,14 @@
     "docgen": "npx projen docgen",
     "eject": "npx projen eject",
     "eslint": "npx projen eslint",
+    "integ": "npx projen integ",
     "integ:kubectl-asset:assert": "npx projen integ:kubectl-asset:assert",
     "integ:kubectl-asset:deploy": "npx projen integ:kubectl-asset:deploy",
     "integ:kubectl-asset:destroy": "npx projen integ:kubectl-asset:destroy",
     "integ:kubectl-asset:snapshot": "npx projen integ:kubectl-asset:snapshot",
     "integ:kubectl-asset:watch": "npx projen integ:kubectl-asset:watch",
     "integ:snapshot-all": "npx projen integ:snapshot-all",
+    "integ:update": "npx projen integ:update",
     "package": "npx projen package",
     "package-all": "npx projen package-all",
     "package:dotnet": "npx projen package:dotnet",
@@ -32,26 +34,32 @@
     "post-upgrade": "npx projen post-upgrade",
     "pre-compile": "npx projen pre-compile",
     "release:kubectl-v20/main": "npx projen release:kubectl-v20/main",
+    "rosetta:extract": "npx projen rosetta:extract",
     "test": "npx projen test",
     "test:watch": "npx projen test:watch",
     "unbump": "npx projen unbump",
     "upgrade": "npx projen upgrade",
+    "upgrade-cdklabs-projen-project-types": "npx projen upgrade-cdklabs-projen-project-types",
+    "upgrade-dev-deps": "npx projen upgrade-dev-deps",
     "watch": "npx projen watch",
     "projen": "npx projen"
   },
   "author": {
-    "name": "Amazon Web Services, Inc.",
+    "name": "Amazon Web Services",
     "email": "aws-cdk-dev@amazon.com",
-    "organization": false
+    "organization": true
   },
   "devDependencies": {
+    "@aws-cdk/integ-runner": "latest",
+    "@aws-cdk/integ-tests-alpha": "latest",
     "@stylistic/eslint-plugin": "^2",
     "@types/jest": "^27",
-    "@types/node": "ts5.5",
+    "@types/node": "^18",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
     "aws-cdk": "^2",
     "aws-cdk-lib": "^2.0.0",
+    "cdklabs-projen-project-types": "^0.3.14",
     "commit-and-tag-version": "^12",
     "constructs": "^10.0.5",
     "eslint": "^9",
diff --git a/rosetta/default.ts-fixture b/rosetta/default.ts-fixture
new file mode 100644
index 00000000..33ecad80
--- /dev/null
+++ b/rosetta/default.ts-fixture
@@ -0,0 +1,13 @@
+// Fixture with packages imported, but nothing else
+import { Construct } from 'constructs';
+import {
+  Stack,
+} from 'aws-cdk-lib';
+
+class Fixture extends Stack {
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    /// here
+  }
+}
\ No newline at end of file
diff --git a/test/kubectl-asset.integ.snapshot/lambda-layer-kubectl-integ-stack.assets.json b/test/kubectl-asset.integ.snapshot/lambda-layer-kubectl-integ-stack.assets.json
index 5ccdb938..86efafe5 100644
--- a/test/kubectl-asset.integ.snapshot/lambda-layer-kubectl-integ-stack.assets.json
+++ b/test/kubectl-asset.integ.snapshot/lambda-layer-kubectl-integ-stack.assets.json
@@ -1,5 +1,5 @@
 {
-  "version": "48.0.0",
+  "version": "50.0.0",
   "files": {
     "07aae4eff01fbf4a54ce6dc5c34000cf2a6c6e18567992cf42e549ac25a80afe": {
       "displayName": "layer-asset",
diff --git a/yarn.lock b/yarn.lock
index 7ffec662..8865667d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12,21 +12,49 @@
   resolved "https://registry.yarnpkg.com/@aws-cdk/asset-node-proxy-agent-v6/-/asset-node-proxy-agent-v6-2.1.0.tgz#6d3c7860354d4856a7e75375f2f0ecab313b4989"
   integrity sha512-7bY3J8GCVxLupn/kNmpPc5VJz8grx+4RKfnnJiO1LG+uxkZfANZG3RMHhE+qQxxwkyQ9/MfPtTpf748UhR425A==
 
-"@aws-cdk/cloud-assembly-api@^2.0.0":
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/@aws-cdk/cloud-assembly-api/-/cloud-assembly-api-2.1.0.tgz#c05e31cbf9f0a2bfd118471599e8eaf998ea4458"
-  integrity sha512-fKNGg0aDAKKKwJJtuauvYYAcNwKZlZ18/Ow2Uq9CKIScfiZuvZFDZpMdYmEvvoD7FViYr/XP4K3yL3fYVZODRw==
+"@aws-cdk/aws-service-spec@0.1.132":
+  version "0.1.132"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/aws-service-spec/-/aws-service-spec-0.1.132.tgz#412620ede3ade13fd8babdc5866c574b0c471a18"
+  integrity sha512-vktB5dmEVVzh6y3dQOWYpVtwx1kHRlKGFPRAdY+c+AuBUrhBKVYx3j+cZDbuc/L+hvRVS86uUEdmr4hw+XAt6Q==
+  dependencies:
+    "@aws-cdk/service-spec-types" "^0.0.198"
+    "@cdklabs/tskb" "^0.0.4"
+
+"@aws-cdk/cloud-assembly-api@^2.0.1":
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/cloud-assembly-api/-/cloud-assembly-api-2.1.1.tgz#9eb535fbe74d0972fd299661cabfce79b6d90181"
+  integrity sha512-lIFgatwM/jmeKU629aaPv+VR+wYYIBXHmId+UBxR65JxhZ+TQD6QWDzkpjPRPKlGw7Rz8gNXs4eEYv98voxvAw==
   dependencies:
     jsonschema "~1.4.1"
     semver "^7.7.3"
 
-"@aws-cdk/cloud-assembly-schema@^48.20.0":
-  version "48.20.0"
-  resolved "https://registry.yarnpkg.com/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-48.20.0.tgz#a2b60373cfbe228f901f62f0d7e2c5e2fe40702d"
-  integrity sha512-+eeiav9LY4wbF/EFuCt/vfvi/Zoxo8bf94PW5clbMraChEliq83w4TbRVy0jB9jE0v1ooFTtIjSQkowSPkfISg==
+"@aws-cdk/cloud-assembly-schema@^50.3.0":
+  version "50.4.0"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-50.4.0.tgz#56399b22494e2e970614ae32ef53316b3b028440"
+  integrity sha512-9Cplwc5C+SNe3hMfqZET7gXeM68tiH2ytQytCi+zz31Bn7O3GAgAnC2dYe+HWnZAgVH788ZkkBwnYXkeqx7v4g==
   dependencies:
     jsonschema "~1.4.1"
-    semver "^7.7.2"
+    semver "^7.7.3"
+
+"@aws-cdk/integ-runner@latest":
+  version "2.196.0"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/integ-runner/-/integ-runner-2.196.0.tgz#1524172b8a600879ae4305b2e0309cd9fdde9fb9"
+  integrity sha512-e39IyM+YaZc/mRCi7CqmJTf/1cxoLKQJpZrdb38uTSYkiTc3wIRD+NPRmn+YqBVbbKoAaZ7LbGS8sBoLAzuy8w==
+  dependencies:
+    "@aws-cdk/aws-service-spec" "0.1.132"
+    aws-cdk "2.1106.0"
+
+"@aws-cdk/integ-tests-alpha@latest":
+  version "2.238.0-alpha.0"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/integ-tests-alpha/-/integ-tests-alpha-2.238.0-alpha.0.tgz#b9cc7cf058d1b0f906b51c222f40b80153d448c9"
+  integrity sha512-SK8eKlDGJj5czF2EMQCrD2sKNN6EhH7p46h+fsmLeButb0heBEPJax+rCcHgPdcl462J3vZaq+RDb9qQotS07g==
+
+"@aws-cdk/service-spec-types@^0.0.198":
+  version "0.0.198"
+  resolved "https://registry.yarnpkg.com/@aws-cdk/service-spec-types/-/service-spec-types-0.0.198.tgz#4a55de541c0f67a84fdd97dd47398383d6cd66c4"
+  integrity sha512-oksZShBGTW/W7HnsnWU3N/YZGkWCbZ/4naFwYYVbXNfpTLauz5ME94SQwyHWG7U7ohjN57JR8DvdGfHVs6PTzg==
+  dependencies:
+    "@cdklabs/tskb" "^0.0.4"
 
 "@babel/code-frame@^7.0.0", "@babel/code-frame@^7.12.13", "@babel/code-frame@^7.28.6", "@babel/code-frame@^7.29.0":
   version "7.29.0"
@@ -294,6 +322,11 @@
   resolved "https://registry.yarnpkg.com/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz#75a2e8b51cb758a7553d6804a5932d7aace75c39"
   integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==
 
+"@cdklabs/tskb@^0.0.4":
+  version "0.0.4"
+  resolved "https://registry.yarnpkg.com/@cdklabs/tskb/-/tskb-0.0.4.tgz#6d7af32427ef947dddcb6f1f1d76d75924e33323"
+  integrity sha512-NFx1X0l7p5DyHtLLEyNeh1hPN4UN9hTkZkzFs/Mp+kFk7dpdINGmGVpCfRDjJ2DrcNSNENUmT+w8g73TvmBbTw==
+
 "@cspotcode/source-map-support@^0.8.0":
   version "0.8.1"
   resolved "https://registry.yarnpkg.com/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz#00629c35a688e05a88b1cda684fb9d5e73f000a1"
@@ -887,13 +920,20 @@
   resolved "https://registry.yarnpkg.com/@types/minimist/-/minimist-1.2.5.tgz#ec10755e871497bcd83efe927e43ec46e8c0747e"
   integrity sha512-hov8bUuiLiyFPGyFPE1lwWhmzYbirOXQNNo40+y3zow8aFVTeyn3VWL0VFFfdNddA8S4Vf0Tc062rzyNr7Paag==
 
-"@types/node@*", "@types/node@ts5.5":
+"@types/node@*":
   version "25.2.3"
   resolved "https://registry.yarnpkg.com/@types/node/-/node-25.2.3.tgz#9c18245be768bdb4ce631566c7da303a5c99a7f8"
   integrity sha512-m0jEgYlYz+mDJZ2+F4v8D1AyQb+QzsNqRuI7xg1VQX/KlKS0qT9r1Mo16yo5F/MtifXFgaofIFsdFMox2SxIbQ==
   dependencies:
     undici-types "~7.16.0"
 
+"@types/node@^18":
+  version "18.19.130"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-18.19.130.tgz#da4c6324793a79defb7a62cba3947ec5add00d59"
+  integrity sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==
+  dependencies:
+    undici-types "~5.26.4"
+
 "@types/normalize-package-data@^2.4.0":
   version "2.4.4"
   resolved "https://registry.yarnpkg.com/@types/normalize-package-data/-/normalize-package-data-2.4.4.tgz#56e2cc26c397c038fab0e3a917a12d5c5909e901"
@@ -1361,14 +1401,14 @@ available-typed-arrays@^1.0.7:
     possible-typed-array-names "^1.0.0"
 
 aws-cdk-lib@^2.0.0:
-  version "2.238.0"
-  resolved "https://registry.yarnpkg.com/aws-cdk-lib/-/aws-cdk-lib-2.238.0.tgz#5ebce5885891dbc016f6e819b87c80914f6d842d"
-  integrity sha512-lmS7DEGcEjNhnl88Z7SynPA1UHdCOkx2pNSGiiBQG5I2jH8H2nnWnr6cZRWmxV2GyNeBmmd9wHdEcSBpkow53Q==
+  version "2.239.0"
+  resolved "https://registry.yarnpkg.com/aws-cdk-lib/-/aws-cdk-lib-2.239.0.tgz#96ef21d7c97bbd957a0e2925531e5d55504b8a3e"
+  integrity sha512-0qpYrE4HL6yRaQriRukfX7m82vNj3otce6v4Y5qK859ILdZBCaz/wqqYgdTnFh6LcA11GAg/Y8l8a+j/VtczyA==
   dependencies:
     "@aws-cdk/asset-awscli-v1" "2.2.263"
     "@aws-cdk/asset-node-proxy-agent-v6" "^2.1.0"
-    "@aws-cdk/cloud-assembly-api" "^2.0.0"
-    "@aws-cdk/cloud-assembly-schema" "^48.20.0"
+    "@aws-cdk/cloud-assembly-api" "^2.0.1"
+    "@aws-cdk/cloud-assembly-schema" "^50.3.0"
     "@balena/dockerignore" "^1.0.2"
     case "1.6.3"
     fs-extra "^11.3.3"
@@ -1377,11 +1417,11 @@ aws-cdk-lib@^2.0.0:
     mime-types "^2.1.35"
     minimatch "^3.1.2"
     punycode "^2.3.1"
-    semver "^7.7.3"
+    semver "^7.7.4"
     table "^6.9.0"
     yaml "1.10.2"
 
-aws-cdk@^2:
+aws-cdk@2.1106.0, aws-cdk@^2:
   version "2.1106.0"
   resolved "https://registry.yarnpkg.com/aws-cdk/-/aws-cdk-2.1106.0.tgz#3a724a54d8d32f01ce98e503debeda043353c1d8"
   integrity sha512-1tyQNnuCnH3nc0QpOL84UNhr+y73fyS75nwSnuy5z7XtRwdsOuqyqcDxd6tvCXkUBA7fdgu8p1FR3hkqrW0GWA==
@@ -1577,6 +1617,13 @@ case@1.6.3, case@^1.6.3:
   resolved "https://registry.yarnpkg.com/case/-/case-1.6.3.tgz#0a4386e3e9825351ca2e6216c60467ff5f1ea1c9"
   integrity sha512-mzDSXIPaFwVDvZAHqZ9VlbyF4yyXRuX6IvB06WvPYkqJVO24kX1PPhv9bfpKNFZyxYFmmgo03HUiD8iklmJYRQ==
 
+cdklabs-projen-project-types@^0.3.14:
+  version "0.3.14"
+  resolved "https://registry.yarnpkg.com/cdklabs-projen-project-types/-/cdklabs-projen-project-types-0.3.14.tgz#05ec106d075ad3d80ab6ad4a64f1a992612c7290"
+  integrity sha512-Olt6l4hxZFZDHwKRXA+/dVOw0E9FqBckkFckl3hSyxy5M019Qwbyc7lqGX8QLP9Dl7pqvYV6lYx/GB0J4YJWRw==
+  dependencies:
+    yaml "^2.8.2"
+
 chalk@^2.4.2:
   version "2.4.2"
   resolved "https://registry.yarnpkg.com/chalk/-/chalk-2.4.2.tgz#cd42541677a54333cf541a49108c1432b44c9424"
@@ -1746,11 +1793,16 @@ concat-stream@^2.0.0:
     readable-stream "^3.0.2"
     typedarray "^0.0.6"
 
-constructs@^10.0.0, constructs@^10.0.5:
+constructs@^10.0.0:
   version "10.4.5"
   resolved "https://registry.yarnpkg.com/constructs/-/constructs-10.4.5.tgz#d06c9b33f8d1668ed36036c62e2e98dadfa1ed31"
   integrity sha512-fOoP70YLevMZr5avJHx2DU3LNYmC6wM8OwdrNewMZou1kZnPGOeVzBrRjZNgFDHUlulYUjkpFRSpTE3D+n+ZSg==
 
+constructs@^10.0.5:
+  version "10.5.1"
+  resolved "https://registry.yarnpkg.com/constructs/-/constructs-10.5.1.tgz#5b5809b4b42e49e41f88f06dea1b14837cad4694"
+  integrity sha512-f/TfFXiS3G/yVIXDjOQn9oTlyu9Wo7Fxyjj7lb8r92iO81jR2uST+9MstxZTmDGx/CgIbxCXkFXgupnLTNxQZg==
+
 conventional-changelog-angular@^6.0.0:
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/conventional-changelog-angular/-/conventional-changelog-angular-6.0.0.tgz#a9a9494c28b7165889144fd5b91573c4aa9ca541"
@@ -5662,6 +5714,11 @@ unbox-primitive@^1.1.0:
     has-symbols "^1.1.0"
     which-boxed-primitive "^1.1.1"
 
+undici-types@~5.26.4:
+  version "5.26.5"
+  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-5.26.5.tgz#bcd539893d00b56e964fd2657a4866b221a65617"
+  integrity sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==
+
 undici-types@~7.16.0:
   version "7.16.0"
   resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.16.0.tgz#ffccdff36aea4884cbfce9a750a0580224f58a46"
@@ -5982,7 +6039,7 @@ yaml@1.10.2:
   resolved "https://registry.yarnpkg.com/yaml/-/yaml-1.10.2.tgz#2301c5ffbf12b467de8da2333a459e29e7920e4b"
   integrity sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==
 
-yaml@^2.2.2, yaml@^2.6.0:
+yaml@^2.2.2, yaml@^2.6.0, yaml@^2.8.2:
   version "2.8.2"
   resolved "https://registry.yarnpkg.com/yaml/-/yaml-2.8.2.tgz#5694f25eca0ce9c3e7a9d9e00ce0ddabbd9e35c5"
   integrity sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==