diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 5a45f81988..478e5b34b6 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -17,6 +17,9 @@ jobs:
     name: "Build and unit tests"
     runs-on: self-hosted
     if: ${{ !contains(github.event.pull_request.title, '[skip ci]') }}
+    permissions:
+      checks: write
+      pull-requests: write
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     container:
diff --git a/build.sbt b/build.sbt
index 815436aa72..8c3c7c797b 100644
--- a/build.sbt
+++ b/build.sbt
@@ -45,11 +45,11 @@ lazy val V = new {
   val munitZio = "0.2.0"
 
   // https://mvnrepository.com/artifact/dev.zio/zio
-  val zio = "2.0.22"
-  val zioConfig = "4.0.1"
-  val zioLogging = "2.1.17"
+  val zio = "2.1.1"
+  val zioConfig = "4.0.2"
+  val zioLogging = "2.2.4"
   val zioJson = "0.6.2"
-  val zioHttp = "3.0.0-RC6"
+  val zioHttp = "3.0.0-RC7"
   val zioCatsInterop = "3.3.0" // TODO "23.1.0.2" // https://mvnrepository.com/artifact/dev.zio/zio-interop-cats
   val zioMetricsConnector = "2.3.1"
   val zioMock = "1.0.0-RC12"
@@ -79,7 +79,7 @@ lazy val V = new {
   val scalaUri = "4.0.3"
 
   val jwtCirceVersion = "9.4.6"
-  val zioPreludeVersion = "1.0.0-RC24"
+  val zioPreludeVersion = "1.0.0-RC26"
 
   val apollo = "1.3.5"
 
diff --git a/cloud-agent/service/server/src/main/scala/org/hyperledger/identus/agent/server/Modules.scala b/cloud-agent/service/server/src/main/scala/org/hyperledger/identus/agent/server/Modules.scala
index 492fb55b7c..dffbfcf89e 100644
--- a/cloud-agent/service/server/src/main/scala/org/hyperledger/identus/agent/server/Modules.scala
+++ b/cloud-agent/service/server/src/main/scala/org/hyperledger/identus/agent/server/Modules.scala
@@ -50,7 +50,7 @@ import zio.http.Client
 
 object SystemModule {
 
-  private val tmp: IO[Config.Error, AppConfig] =
+  val configLayer: ZLayer[Any, Config.Error, AppConfig] = ZLayer.fromZIO(
     for {
       ret: AppConfig <- TypesafeConfigProvider
         .fromTypesafeConfig(ConfigFactory.load())
@@ -58,8 +58,7 @@ object SystemModule {
       _ <- ZIO.log(s"HTTP server endpoint is setup as '${ret.agent.httpEndpoint.publicEndpointUrl}'")
       _ <- ZIO.log(s"DIDComm server endpoint is setup as '${ret.agent.didCommEndpoint.publicEndpointUrl}'")
     } yield ret
-
-  val configLayer = ZLayer.fromZIO(tmp)
+  )
 
   val zioHttpClientLayer: ZLayer[Any, Throwable, Client] = {
     import zio.http.netty.NettyConfig
@@ -232,36 +231,31 @@ object RepoModule {
   }
 
   val allSecretStorageLayer: TaskLayer[DIDSecretStorage & WalletSecretStorage & GenericSecretStorage] = {
-    ZLayer.fromZIO {
-      ZIO
-        .service[AppConfig]
-        .map(_.agent.secretStorage)
-        .tap(conf => ZIO.logInfo(s"Using '${conf.backend}' as a secret storage backend"))
-        .flatMap { conf =>
-          val useSemanticPath = conf.vault.map(_.useSemanticPath).getOrElse(true)
-          conf.backend match {
-            case SecretStorageBackend.vault =>
-              ZIO.succeed(
-                ZLayer.make[DIDSecretStorage & WalletSecretStorage & GenericSecretStorage](
-                  VaultDIDSecretStorage.layer(useSemanticPath),
-                  VaultGenericSecretStorage.layer(useSemanticPath),
-                  VaultWalletSecretStorage.layer,
-                  vaultClientLayer,
-                )
-              )
-            case SecretStorageBackend.postgres =>
-              ZIO.succeed(
-                ZLayer.make[DIDSecretStorage & WalletSecretStorage & GenericSecretStorage](
-                  JdbcDIDSecretStorage.layer,
-                  JdbcGenericSecretStorage.layer,
-                  JdbcWalletSecretStorage.layer,
-                  agentContextAwareTransactorLayer,
-                )
-              )
-          }
+    SystemModule.configLayer
+      .tap { config =>
+        val backend = config.get.agent.secretStorage.backend
+        ZIO.logInfo(s"Using '${backend}' as a secret storage backend")
+      }
+      .flatMap { config =>
+        val secretStorageConfig = config.get.agent.secretStorage
+        val useSemanticPath = secretStorageConfig.vault.map(_.useSemanticPath).getOrElse(true)
+        secretStorageConfig.backend match {
+          case SecretStorageBackend.vault =>
+            ZLayer.make[DIDSecretStorage & WalletSecretStorage & GenericSecretStorage](
+              VaultDIDSecretStorage.layer(useSemanticPath),
+              VaultGenericSecretStorage.layer(useSemanticPath),
+              VaultWalletSecretStorage.layer,
+              vaultClientLayer,
+            )
+          case SecretStorageBackend.postgres =>
+            ZLayer.make[DIDSecretStorage & WalletSecretStorage & GenericSecretStorage](
+              JdbcDIDSecretStorage.layer,
+              JdbcGenericSecretStorage.layer,
+              JdbcWalletSecretStorage.layer,
+              agentContextAwareTransactorLayer,
+            )
         }
-        .provide(SystemModule.configLayer)
-    }.flatten
+      }
   }
 
 }
diff --git a/examples/st-multi/README.md b/examples/st-multi/README.md
new file mode 100644
index 0000000000..e30ec1f2ba
--- /dev/null
+++ b/examples/st-multi/README.md
@@ -0,0 +1,7 @@
+## Configuration
+
+| Exposed Service              | Description                            |
+|------------------------------|----------------------------------------|
+| `localhost:8080/cloud-agent` | Single-tenant Cloud Agent#1 (issuer)   |
+| `localhost:8081/cloud-agent` | Single-tenant Cloud Agent#2 (holder)   |
+| `localhost:8082/cloud-agent` | Single-tenant Cloud Agent#3 (verifier) |
diff --git a/examples/st-multi/README.me b/examples/st-multi/README.me
deleted file mode 100644
index da8c69f181..0000000000
--- a/examples/st-multi/README.me
+++ /dev/null
@@ -1,7 +0,0 @@
-## Configuration
-
-|Exposed Service             |Description                           |
-|----------------------------|--------------------------------------|
-|`localhost:8080/cloud-agent`|Single-tenant Cloud Agent#1 (issuer)  |
-|`localhost:8081/cloud-agent`|Single-tenant Cloud Agent#2 (holder)  |
-|`localhost:8082/cloud-agent`|Single-tenant Cloud Agent#3 (verifier)|