diff --git a/.github/actions/gradle-setup-action/action.yml b/.github/actions/gradle-setup-action/action.yml
index d3231bc92..6c5bb7041 100644
--- a/.github/actions/gradle-setup-action/action.yml
+++ b/.github/actions/gradle-setup-action/action.yml
@@ -17,7 +17,7 @@ runs:
       with:
         distribution: 'temurin'
         java-version: '21'
-    - name: Gradle wrapper validation
-      uses: gradle/actions/wrapper-validation@v4
     - name: Setup Gradle
       uses: gradle/actions/setup-gradle@v4
+    - name: Gradle wrapper validation
+      uses: gradle/actions/wrapper-validation@v4
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 036fe5c17..4c9c765e5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,7 +13,7 @@ jobs:
   version:
     uses: walt-id/waltid-identity/.github/workflows/version.yml@266f5c09359450c39019a6da38f2b331e7122918
   gradle-build:
-    uses: walt-id/waltid-identity/.github/workflows/build-gradle.yml@266f5c09359450c39019a6da38f2b331e7122918
+    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@d3e3284f901bef1e6d80b35720fbae5e4b49a95a
     needs: version
     with:
       version: ${{ needs.version.outputs.release_version }}
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index ffa65b39b..21525f4ea 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Configure gradle
-        uses: ./.github/actions/gradle-setup-action@266f5c09359450c39019a6da38f2b331e7122918
+        uses: walt-id/waltid-identity/.github/actions/gradle-setup-action@f7b46c8ae1c27f1a0873a5ca8dfb0440c77381ec
       - name: Set version
         run: |
           sed -i "s/1.0.0-SNAPSHOT/${{ inputs.version }}/g" build.gradle.kts
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
index fd9425dc4..bdf31d8e7 100644
--- a/.github/workflows/pre-release.yml
+++ b/.github/workflows/pre-release.yml
@@ -11,7 +11,7 @@ jobs:
     with:
       suffix: -SNAPSHOT
   gradle:
-    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@927c4233610e90dd8a57418662fad7293b7b29a4
+    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@d3e3284f901bef1e6d80b35720fbae5e4b49a95a
     secrets: inherit
     needs: version
     with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2c54b01a7..37541394c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
     with:
       preferred: ${{ inputs.release_version }}
   gradle:
-    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@927c4233610e90dd8a57418662fad7293b7b29a4
+    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@d3e3284f901bef1e6d80b35720fbae5e4b49a95a
     secrets: inherit
     needs: version
     with:
diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml
index 8a4c37f4c..ab4a23b20 100644
--- a/.github/workflows/test-deploy.yml
+++ b/.github/workflows/test-deploy.yml
@@ -12,7 +12,7 @@ jobs:
     with:
       preferred: ${{ inputs.release_version }}
   gradle:
-    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@927c4233610e90dd8a57418662fad7293b7b29a4
+    uses: walt-id/waltid-identity/.github/workflows/gradle.yml@d3e3284f901bef1e6d80b35720fbae5e4b49a95a
     secrets: inherit
     needs: version
     with:
diff --git a/waltid-applications/waltid-openid4vc-ios-testApp/shared/src/iosMain/kotlin/id/walt/oid4vc/shared/Wallet.kt b/waltid-applications/waltid-openid4vc-ios-testApp/shared/src/iosMain/kotlin/id/walt/oid4vc/shared/Wallet.kt
index 047def99f..87e6be4d9 100644
--- a/waltid-applications/waltid-openid4vc-ios-testApp/shared/src/iosMain/kotlin/id/walt/oid4vc/shared/Wallet.kt
+++ b/waltid-applications/waltid-openid4vc-ios-testApp/shared/src/iosMain/kotlin/id/walt/oid4vc/shared/Wallet.kt
@@ -13,7 +13,7 @@ import id.walt.oid4vc.data.OpenIDProviderMetadata
 import id.walt.oid4vc.data.dif.DescriptorMapping
 import id.walt.oid4vc.data.dif.PresentationDefinition
 import id.walt.oid4vc.data.dif.PresentationSubmission
-import id.walt.oid4vc.data.dif.VCFormat
+import id.walt.credentials.utils.VCFormat
 import id.walt.oid4vc.errors.PresentationError
 import id.walt.oid4vc.interfaces.PresentationResult
 import id.walt.oid4vc.interfaces.SimpleHttpResponse
@@ -358,7 +358,7 @@ internal class TestCredentialWallet(
     }
 
     override val metadata: OpenIDProviderMetadata
-        get() = createDefaultProviderMetadata()
+        get() = createDefaultProviderMetadata() as OpenIDProviderMetadata.Draft13
 
     override fun getSession(id: String) = sessionCache[id]
     override fun getSessionByAuthServerState(authServerState: String): SIOPSession? {
diff --git a/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml b/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
index 8205476f0..cb989219c 100644
--- a/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
+++ b/waltid-applications/waltid-web-portal/k8s/deployment-dev.yaml
@@ -51,7 +51,12 @@ metadata:
   name: portal-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - portal.test.waltid.cloud
+      secretName: web-portal-tls-secret
   rules:
     - host: portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml b/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
index 1e28edc4e..6751093dc 100644
--- a/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-issuer-api/k8s/deployment-dev.yaml
@@ -65,7 +65,12 @@ metadata:
   name: issuer
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - issuer.portal.test.waltid.cloud
+      secretName: issuer-tls-secret
   rules:
     - host: issuer.portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml b/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
index 9cb7b1fca..81176b295 100644
--- a/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-verifier-api/k8s/deployment-dev.yaml
@@ -74,7 +74,12 @@ metadata:
   name: verifier
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - verifier.portal.test.waltid.cloud
+      secretName: verifier-tls-secret
   rules:
     - host: verifier.portal.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml b/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
index 2fced763f..715d22b37 100644
--- a/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
+++ b/waltid-services/waltid-verifier-api/k8s/opa/deployment-dev.yaml
@@ -47,7 +47,12 @@ metadata:
   name: opa-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - hosts:
+        - opa.test.waltid.cloud
+      secretName: opa-tls-secret
   rules:
     - host: opa.test.waltid.cloud
       http:
diff --git a/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml b/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
index 36708fdc6..87934d448 100644
--- a/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
+++ b/waltid-services/waltid-wallet-api/k8s/deployment-dev.yaml
@@ -238,11 +238,19 @@ metadata:
   name: wallet-ingress
   annotations:
     kubernetes.io/ingress.class: "nginx"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
     ingress.kubernetes.io/configuration-snippet: |
       if ($host ~ ^(.+)\.waltid\.org$) {
         return 301 https://$1.walt-test.cloud$request_uri;
       }
 spec:
+  tls:
+    - hosts:
+        - wallet.test.waltid.cloud
+      secretName: wallet-demo-tls-secret
+    - hosts:
+        - wallet-dev.test.waltid.cloud
+      secretName: wallet-dev-tls-secret
   rules:
     - host: wallet-dev.test.waltid.cloud
       http: