diff --git a/.circleci/config.yml b/.circleci/config.yml
index 071532f..9c9e03d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -80,6 +80,7 @@ commands:
 
 jobs:
   overcommit:
+    working_directory: ~/op-env
     docker:
       - image: apiology/circleci-python:latest
     steps:
diff --git a/.markdownlint_style.rb b/.markdownlint_style.rb
new file mode 100644
index 0000000..c52e6f1
--- /dev/null
+++ b/.markdownlint_style.rb
@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+rule 'MD029', style: 'ordered'
diff --git a/.mdlrc b/.mdlrc
new file mode 100644
index 0000000..99d5308
--- /dev/null
+++ b/.mdlrc
@@ -0,0 +1 @@
+style ".markdownlint_style.rb"
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 93dd091..484bc24 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -22,8 +22,6 @@ Related backlog tasks:
 
 * Do release of cookiecutter-pypackage projects in CircleCI (after other tests pass)
 
-First, make sure version has been bumped:
-
 ```sh
 git checkout main
 git pull
diff --git a/Gemfile b/Gemfile
index 8ce7e69..da5f794 100644
--- a/Gemfile
+++ b/Gemfile
@@ -6,3 +6,5 @@ source 'https://rubygems.org'
 # magit doesn't seem to want to use the bundled version at the moment,
 # so let's favor the more recent version...
 gem 'overcommit', ['>=0.58.0']
+
+gem 'mdl'
diff --git a/Gemfile.lock b/Gemfile.lock
index 69eca87..f2edc03 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,13 +1,32 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    chef-utils (17.10.0)
+      concurrent-ruby
     childprocess (4.0.0)
+    concurrent-ruby (1.1.10)
     iniparse (1.5.0)
+    kramdown (2.4.0)
+      rexml
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
+    mdl (0.11.0)
+      kramdown (~> 2.3)
+      kramdown-parser-gfm (~> 1.1)
+      mixlib-cli (~> 2.1, >= 2.1.1)
+      mixlib-config (>= 2.2.1, < 4)
+      mixlib-shellout
+    mixlib-cli (2.1.8)
+    mixlib-config (3.0.27)
+      tomlrb
+    mixlib-shellout (3.2.7)
+      chef-utils
     overcommit (0.58.0)
       childprocess (>= 0.6.3, < 5)
       iniparse (~> 1.4)
       rexml (~> 3.2)
     rexml (3.2.5)
+    tomlrb (2.0.3)
 
 PLATFORMS
   ruby
@@ -15,7 +34,8 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  mdl
   overcommit (>= 0.58.0)
 
 BUNDLED WITH
-   2.2.3
+   2.2.33
diff --git a/Makefile b/Makefile
index 15600d3..787f96d 100644
--- a/Makefile
+++ b/Makefile
@@ -135,8 +135,8 @@ servedocs: docs ## compile the docs watching for changes
 release: dist ## package and upload a release
 	set -e; \
 	new_version=$$(python3 setup.py --version); \
-	twine upload -u $$(with-op op get item 'PyPI - test' --fields username) -p $$(with-op op get item 'PyPI - test' --fields password) dist/op-env-$${new_version:?}.tar.gz -r testpypi; \
-	twine upload -u $$(with-op op get item 'PyPI' --fields username) -p $$(with-op op get item 'PyPI' --fields password) dist/op-env-$${new_version:?}.tar.gz -r pypi
+	twine upload -u __token__ -p $$(with-op op item get 'PyPI - test' --fields api_key) dist/op-env-$${new_version:?}.tar.gz -r testpypi; \
+	twine upload -u __token__ -p $$(with-op op item get 'PyPI' --fields api_key) dist/op-env-$${new_version:?}.tar.gz -r pypi
 
 dist: clean ## builds source and wheel package
 	python setup.py sdist
diff --git a/fix.sh b/fix.sh
index 1cd49dc..58151a5 100755
--- a/fix.sh
+++ b/fix.sh
@@ -69,7 +69,18 @@ ensure_rbenv() {
 
 latest_ruby_version() {
   major_minor=${1}
-  rbenv install --list 2>/dev/null | grep "^${major_minor}."
+
+  # Double check that this command doesn't error out under -e
+  rbenv install --list >/dev/null 2>&1
+
+  # not sure why, but 'rbenv install --list' below exits with error code
+  # 1...after providing the same output the previous line gave when it
+  # exited with error code 0.
+  #
+  # https://github.com/rbenv/rbenv/issues/1441
+  set +e
+  rbenv install --list 2>/dev/null | cat | grep "^${major_minor}."
+  set -e
 }
 
 ensure_dev_library() {
@@ -91,9 +102,17 @@ ensure_ruby_build_requirements() {
   ensure_dev_library openssl/ssl.h openssl libssl-dev
 }
 
+ensure_latest_ruby_build_definitions() {
+  ensure_rbenv
+
+  git -C "$(rbenv root)"/plugins/ruby-build pull
+}
+
 # You can find out which feature versions are still supported / have
 # been release here: https://www.ruby-lang.org/en/downloads/
 ensure_ruby_versions() {
+  ensure_latest_ruby_build_definitions
+
   # You can find out which feature versions are still supported / have
   # been release here: https://www.ruby-lang.org/en/downloads/
   ruby_versions="$(latest_ruby_version 3.0)"
@@ -302,12 +321,12 @@ ensure_pyenv_virtualenvs() {
 }
 
 ensure_pip_and_wheel() {
-  # Make sure we have a pip with the 20.3 resolver, and after the
-  # initial bugfix release
+  # pip 22 seems to be better at finding pandas pre-compiled wheels
+  # for macOS, so let's make sure we're using at least that version
   major_pip_version=$(pip --version | cut -d' ' -f2 | cut -d '.' -f 1)
   if [[ major_pip_version -lt 21 ]]
   then
-    pip install 'pip>=20.3.1'
+    pip install 'pip>=22'
   fi
   # wheel is helpful for being able to cache long package builds
   pip show wheel >/dev/null 2>&1 || pip install wheel
@@ -359,8 +378,6 @@ ensure_overcommit() {
   fi
 }
 
-ensure_rbenv
-
 ensure_ruby_versions
 
 set_ruby_local_version
diff --git a/requirements_dev.txt b/requirements_dev.txt
index beffc72..9103699 100644
--- a/requirements_dev.txt
+++ b/requirements_dev.txt
@@ -9,11 +9,11 @@ coverage==5.5
 Sphinx==4.3.1
 twine==3.4.1
 pytest==6.2.4
-mypy==0.910
+mypy==0.931
 types-PyYAML==6.0.0
 # lxml is needed for mypy coverage reporting:
 #
 # You must install the lxml package before you can run mypy with `--html-report`.
 # You can do this with `python3 -m pip install lxml`.
-lxml==4.6.5
+lxml==4.9.1
 yamllint==1.26.1