diff --git a/.github/scripts/fix-build-config.sh b/.github/scripts/fix-build-config.sh
index fdbd27bc..4d481dd1 100755
--- a/.github/scripts/fix-build-config.sh
+++ b/.github/scripts/fix-build-config.sh
@@ -5,23 +5,90 @@ JFROG_HOSTNAME="databricks.jfrog.io"
 JFROG_REALM="Artifactory Realm"
 JFROG_USERNAME="gha-service-account"
 JFROG_URL="https://${JFROG_HOSTNAME}/artifactory/db-maven/"
+MAVEN_CENTRAL_URL="https://maven-central.storage.googleapis.com/maven2/"
+
+replace_repo1_in_mill() {
+  python3 - "$1" << 'PY'
+from pathlib import Path
+import sys
+
+path = Path("mill")
+path.write_text(path.read_text().replace("https://repo1.maven.org/maven2", sys.argv[1]))
+PY
+}
+
+force_no_server_in_mill() {
+  python3 - << 'PY'
+from pathlib import Path
+
+path = Path("mill")
+text = path.read_text()
+old = '"${MILL}" $MILL_FIRST_ARG -D "mill.main.cli=${MILL_MAIN_CLI}" "$@"'
+new = '"${MILL}" --no-server $MILL_FIRST_ARG -D "mill.main.cli=${MILL_MAIN_CLI}" "$@"'
+path.write_text(text.replace(old, new))
+PY
+}
+
+add_curl_retries_in_mill() {
+  python3 - << 'PY'
+from pathlib import Path
+
+path = Path("mill")
+text = path.read_text()
+old = 'curl -f -L -o "${MILL_TEMP_DOWNLOAD_FILE}" "${MILL_DOWNLOAD_URL}"'
+new = 'curl --retry 5 --retry-delay 2 --retry-all-errors -f -L -o "${MILL_TEMP_DOWNLOAD_FILE}" "${MILL_DOWNLOAD_URL}"'
+path.write_text(text.replace(old, new))
+PY
+}
 
-# Configure sbt repositories
 mkdir -p ~/.sbt
-cat > ~/.sbt/repositories << EOF
+if [[ "${JFROG_ACCESS_TOKEN}" == "dummy" ]]; then
+  # Fork PRs cannot mint the Databricks JFrog OIDC token. Use public Maven Central directly so new
+  # public dependency versions that have not yet been mirrored to JFrog can still be validated.
+  cat > ~/.sbt/repositories << EOF
+[repositories]
+  local
+  maven-central: ${MAVEN_CENTRAL_URL}
+EOF
+  echo "COURSIER_REPOSITORIES=${MAVEN_CENTRAL_URL}" >> "$GITHUB_ENV"
+  mill_version="$(sed -n -E 's#^//\|[[:space:]]*mill-version:[[:space:]]*([^[:space:]]+).*#\1#p' build.mill | head -n 1)"
+  if [[ -z "${mill_version}" ]]; then mill_version="1.1.0"; fi
+  echo "MILL_VERSION=${mill_version%-jvm}-jvm" >> "$GITHUB_ENV"
+  replace_repo1_in_mill "${MAVEN_CENTRAL_URL%/}"
+  force_no_server_in_mill
+  add_curl_retries_in_mill
+  {
+    echo "-Djava.net.preferIPv4Stack=true"
+    echo "-Djdk.tls.client.protocols=TLSv1.2"
+  } >> .mill-jvm-opts
+else
+  # Configure sbt repositories
+  cat > ~/.sbt/repositories << EOF
 [repositories]
   local
   databricks-jfrog: ${JFROG_URL}
 EOF
 
-# Configure sbt credentials
-cat > ~/.sbt/.credentials << EOF
+  # Configure sbt credentials
+  cat > ~/.sbt/.credentials << EOF
 realm=${JFROG_REALM}
 host=${JFROG_HOSTNAME}
 user=${JFROG_USERNAME}
 password=${JFROG_ACCESS_TOKEN}
 EOF
 
+  mkdir -p ~/.config/coursier
+  {
+    echo "jfrog.host=${JFROG_HOSTNAME}"
+    echo "jfrog.realm=${JFROG_REALM}"
+    echo "jfrog.username=${JFROG_USERNAME}"
+    echo "jfrog.password=${JFROG_ACCESS_TOKEN}"
+  } > ~/.config/coursier/credentials.properties
+
+  echo "COURSIER_REPOSITORIES=${JFROG_URL}" >> "$GITHUB_ENV"
+  replace_repo1_in_mill "https://${JFROG_USERNAME}:${JFROG_ACCESS_TOKEN}@${JFROG_URL:8}"
+fi
+
 # Configure global.sbt to load credentials
 mkdir -p ~/.sbt/1.0
 cat > ~/.sbt/1.0/global.sbt << 'EOF'
@@ -31,15 +98,3 @@ credentials ++= {
   else Nil
 }
 EOF
-
-
-mkdir -p ~/.config/coursier
-{
-  echo "jfrog.host=${JFROG_HOSTNAME}"
-  echo "jfrog.realm=${JFROG_REALM}"
-  echo "jfrog.username=${JFROG_USERNAME}"
-  echo "jfrog.password=${JFROG_ACCESS_TOKEN}"
-} > ~/.config/coursier/credentials.properties
-
-echo "COURSIER_REPOSITORIES=${JFROG_URL}" >> "$GITHUB_ENV"
-sed -i "s|https://repo1.maven.org/maven2|https://${JFROG_USERNAME}:${JFROG_ACCESS_TOKEN}@${JFROG_URL:8}|g" ./mill
diff --git a/build.mill b/build.mill
index 58350b72..4dd0300a 100644
--- a/build.mill
+++ b/build.mill
@@ -261,7 +261,7 @@ object sjsonnet extends VersionFileModule {
       with SjsonnetPublishModule
       with SjsonnetJvmNative {
     def moduleDir = super.moduleDir / os.up
-    def scalaNativeVersion = "0.5.11"
+    def scalaNativeVersion = "0.5.12"
     val sourceDirs = Seq(
       "src",
       "src-native",
diff --git a/sjsonnet/src-native/sjsonnet/Platform.scala b/sjsonnet/src-native/sjsonnet/Platform.scala
index ab8f580e..7bbdc50c 100644
--- a/sjsonnet/src-native/sjsonnet/Platform.scala
+++ b/sjsonnet/src-native/sjsonnet/Platform.scala
@@ -4,6 +4,7 @@ import java.io.{ByteArrayOutputStream, File}
 import java.nio.charset.StandardCharsets.UTF_8
 import java.util
 import java.util.Base64
+import java.util.HexFormat
 import java.util.zip.GZIPOutputStream
 import scala.scalanative.regex.Pattern
 import scala.annotation.nowarn
@@ -11,7 +12,7 @@ import scala.collection.mutable
 import org.virtuslab.yaml.*
 
 object Platform {
-  private val hexChars = "0123456789abcdef".toCharArray
+  private val hexFormat = HexFormat.of()
 
   private def repeatCapacity(s: String, count: Int): Int =
     if (count > 0 && s.length <= Int.MaxValue / count) s.length * count else 0
@@ -172,22 +173,10 @@ object Platform {
     result.mkString("\n")
   }
 
-  private def bytesToHex(bytes: Array[Byte]): String = {
-    val out = new Array[Char](bytes.length * 2)
-    var i = 0
-    var j = 0
-    while (i < bytes.length) {
-      val b = bytes(i) & 0xff
-      out(j) = hexChars(b >>> 4)
-      out(j + 1) = hexChars(b & 0x0f)
-      i += 1
-      j += 2
-    }
-    new String(out)
-  }
-
   private def computeHash(algorithm: String, s: String): String =
-    bytesToHex(java.security.MessageDigest.getInstance(algorithm).digest(s.getBytes(UTF_8)))
+    hexFormat.formatHex(
+      java.security.MessageDigest.getInstance(algorithm).digest(s.getBytes(UTF_8))
+    )
 
   def md5(s: String): String = computeHash("MD5", s)