diff --git a/Makefile b/Makefile
index a21360a34..93d0c8da7 100644
--- a/Makefile
+++ b/Makefile
@@ -44,7 +44,7 @@ attributes: prepare
 		> "${managed_partials}/attributes.adoc"
 	docs/bin/version.sh | xargs -0  printf ":akka-javasdk-version: %s" \
 		> "${managed_partials}/attributes.adoc"
-	echo ":akka-cli-version: 3.0.7"     >> "${managed_partials}/attributes.adoc"
+	echo ":akka-cli-version: 3.0.8"     >> "${managed_partials}/attributes.adoc"
 	echo ":akka-cli-min-version: 3.0.4" >> "${managed_partials}/attributes.adoc"
 	# see https://adoptium.net/marketplace/
 	echo ":java-version: 21" \
diff --git a/akka-javasdk-maven/akka-javasdk-parent/pom.xml b/akka-javasdk-maven/akka-javasdk-parent/pom.xml
index ac8ea2f5f..23c03ec0a 100644
--- a/akka-javasdk-maven/akka-javasdk-parent/pom.xml
+++ b/akka-javasdk-maven/akka-javasdk-parent/pom.xml
@@ -38,7 +38,7 @@
 
         <!-- These are dependent on runtime environment and cannot be customized by users -->
         <maven.compiler.release>21</maven.compiler.release>
-        <kalix-runtime.version>1.2.2</kalix-runtime.version>
+        <kalix-runtime.version>1.2.5</kalix-runtime.version>
 
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <skip.docker>false</skip.docker>
diff --git a/akka-javasdk-testkit/src/main/java/akka/javasdk/testkit/TestKit.java b/akka-javasdk-testkit/src/main/java/akka/javasdk/testkit/TestKit.java
index 17072d564..0579f48fb 100644
--- a/akka-javasdk-testkit/src/main/java/akka/javasdk/testkit/TestKit.java
+++ b/akka-javasdk-testkit/src/main/java/akka/javasdk/testkit/TestKit.java
@@ -461,7 +461,7 @@ public SpiSettings getSettings() {
               proxyPort,
               settings.aclEnabled,
               false,
-              settings.serviceName,
+              settings.serviceName + "-IT-" + System.currentTimeMillis(),
               eventingSettings,
               mockedEventingSettings,
               true);
diff --git a/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala b/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
index 172ef9880..186e05af4 100644
--- a/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
+++ b/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
@@ -149,7 +149,8 @@ class SdkRunner private (dependencyProvider: Option[DependencyProvider]) extends
         startContext.remoteIdentification,
         startContext.tracerFactory,
         dependencyProvider,
-        startedPromise)
+        startedPromise,
+        getSettings.devMode.map(_.serviceName))
       Future.successful(app.spiEndpoints)
     } catch {
       case NonFatal(ex) =>
@@ -261,7 +262,8 @@ private final class Sdk(
     remoteIdentification: Option[RemoteIdentification],
     tracerFactory: String => Tracer,
     dependencyProviderOverride: Option[DependencyProvider],
-    startedPromise: Promise[StartupContext]) {
+    startedPromise: Promise[StartupContext],
+    serviceNameOverride: Option[String]) {
   private val logger = LoggerFactory.getLogger(getClass)
   private val messageCodec = new JsonMessageCodec
   private val ComponentLocator.LocatedClasses(componentClasses, maybeServiceClass) =
@@ -442,7 +444,7 @@ private final class Sdk(
       case _ => None
     }
 
-    val devModeServiceName = sdkSettings.devModeSettings.map(_.serviceName)
+    val devModeServiceName = serviceNameOverride.orElse(sdkSettings.devModeSettings.map(_.serviceName))
     val discoveryEndpoint =
       new DiscoveryImpl(
         classicSystem,
diff --git a/docs/src/modules/reference/pages/cli/akka-cli/akka_auth_tokens_create.adoc b/docs/src/modules/reference/pages/cli/akka-cli/akka_auth_tokens_create.adoc
index d85ff5870..bf7f58614 100644
--- a/docs/src/modules/reference/pages/cli/akka-cli/akka_auth_tokens_create.adoc
+++ b/docs/src/modules/reference/pages/cli/akka-cli/akka_auth_tokens_create.adoc
@@ -23,7 +23,8 @@ Token created: 0123456789abcdef0123456789abcdef0123456789abcdef
 ----
       --description string   A description of the token. If the token is a refresh token, this will be stored with the token for reference.
   -h, --help                 help for create
-      --scopes stringArray   The scopes for the token. Valid scopes are: all, container_registry, execution, organizations, projects, user (default [execution])
+      --scopes stringArray   The scopes for the token. Valid scopes are: all, container_registry, execution, organizations, projects, user. Only applies to refresh tokens. (default [execution])
+      --type string          The type of token to create, either access or refresh (default "refresh")
 ----
 
 == Options inherited from parent commands
diff --git a/docs/src/modules/reference/pages/release-notes.adoc b/docs/src/modules/reference/pages/release-notes.adoc
index 0bd8bdcd6..2d60cdf59 100644
--- a/docs/src/modules/reference/pages/release-notes.adoc
+++ b/docs/src/modules/reference/pages/release-notes.adoc
@@ -12,6 +12,9 @@ Current versions
 
 == December 2024
 
+* Akka CLI 3.0.8
+    - Updates to configure SSO integrations
+
 * https://github.com/akka/akka-sdk/releases/tag/v3.0.2[Akka SDK 3.0.2]
     - Integration Tests are now bound to `mvn integration-test` and not a specific profile
 
diff --git a/docs/supplemental_ui/js/vendor/js.cookie.min.js b/docs/supplemental_ui/js/vendor/js.cookie.min.js
deleted file mode 100644
index 90a767223..000000000
--- a/docs/supplemental_ui/js/vendor/js.cookie.min.js
+++ /dev/null
@@ -1,2 +0,0 @@
-/*! js-cookie v3.0.1 | MIT */
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self,function(){var n=e.Cookies,o=e.Cookies=t();o.noConflict=function(){return e.Cookies=n,o}}())}(this,(function(){"use strict";function e(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var o in n)e[o]=n[o]}return e}return function t(n,o){function r(t,r,i){if("undefined"!=typeof document){"number"==typeof(i=e({},o,i)).expires&&(i.expires=new Date(Date.now()+864e5*i.expires)),i.expires&&(i.expires=i.expires.toUTCString()),t=encodeURIComponent(t).replace(/%(2[346B]|5E|60|7C)/g,decodeURIComponent).replace(/[()]/g,escape);var c="";for(var u in i)i[u]&&(c+="; "+u,!0!==i[u]&&(c+="="+i[u].split(";")[0]));return document.cookie=t+"="+n.write(r,t)+c}}return Object.create({set:r,get:function(e){if("undefined"!=typeof document&&(!arguments.length||e)){for(var t=document.cookie?document.cookie.split("; "):[],o={},r=0;r<t.length;r++){var i=t[r].split("="),c=i.slice(1).join("=");try{var u=decodeURIComponent(i[0]);if(o[u]=n.read(c,u),e===u)break}catch(e){}}return e?o[e]:o}},remove:function(t,n){r(t,"",e({},n,{expires:-1}))},withAttributes:function(n){return t(this.converter,e({},this.attributes,n))},withConverter:function(n){return t(e({},this.converter,n),this.attributes)}},{attributes:{value:Object.freeze(o)},converter:{value:Object.freeze(n)}})}({read:function(e){return'"'===e[0]&&(e=e.slice(1,-1)),e.replace(/(%[\dA-F]{2})+/gi,decodeURIComponent)},write:function(e){return encodeURIComponent(e).replace(/%(2[346BF]|3[AC-F]|40|5[BDE]|60|7[BCD])/g,decodeURIComponent)}},{path:"/"})}));
diff --git a/docs/supplemental_ui/partials/footer-scripts-supplemental.hbs b/docs/supplemental_ui/partials/footer-scripts-supplemental.hbs
index 47ea07cd6..f672e50d9 100644
--- a/docs/supplemental_ui/partials/footer-scripts-supplemental.hbs
+++ b/docs/supplemental_ui/partials/footer-scripts-supplemental.hbs
@@ -1,77 +1 @@
-<script src="{{uiRootPath}}/js/vendor/js.cookie.min.js" ></script>
-<script type="text/plain" class="optanon-category-3">
-    (function(apiKey){
-        (function(p,e,n,d,o){var v,w,x,y,z;o=p[d]=p[d]||{};o._q=o._q||[];
-        v=['initialize','identify','updateOptions','pageLoad','track'];for(w=0,x=v.length;w<x;++w)(function(m){
-            o[m]=o[m]||function(){o._q[m===v[0]?'unshift':'push']([m].concat([].slice.call(arguments,0)));};})(v[w]);
-            y=e.createElement(n);y.async=!0;y.src='https://content.pa.lightbend.com/agent/static/'+apiKey+'/pendo.js';
-            z=e.getElementsByTagName(n)[0];z.parentNode.insertBefore(y,z);})(window,document,'script','pendo');
-
-    const getEnv = () => {
-    const { hostname } = window.location;
-    switch (hostname) {
-        case "localhost":
-        return "localhost";
-        case "doc.akka.io":
-        return "prod";
-        default:
-        if (hostname.includes("akka.work")) {
-            return "workbench";
-        }
-        return "unknown";
-    }
-    };
-
-    // NOTE: doc https://support.pendo.io/hc/en-us/articles/360037760572-Tracking-Anonymous-Visitors-Across-Subdomains
-    const getCookieDomain = () => {
-    const { hostname } = window.location;
-    switch (hostname) {
-        case "localhost":
-        return "localhost";
-        case "doc.akka.io":
-        return ".akka.io";
-        default:
-        if (hostname.includes("akka.work")) {
-            return ".akka.work";
-        }
-        return "unknown";
-    }
-    };
-
-    const saveCookie = (userId) => {
-    Cookies.set('_track_pv', userId.replace("users/", ""),  { domain: getCookieDomain(), expires: 35 });
-    };
-
-    // read userId from cookie
-    const userId = Cookies.get('_track_pv');
-
-    if (userId && userId !== "undefined") {
-    pendo.initialize({
-        visitor: {
-        id: userId.startsWith("_PENDO_T_") ? userId : "users/" + userId,
-        environment: getEnv()
-        },
-        cookieDomain: getCookieDomain()
-    });
-
-    // save cookie to update cookie expiration date
-    saveCookie(userId);
-    } else {
-    pendo.initialize({
-        visitor: {
-        environment: getEnv()
-        },
-        cookieDomain: getCookieDomain()
-    });
-
-    // save visitorId to cookie
-    setTimeout(() => {
-        const visitorId = pendo.visitorId
-        if (visitorId) {
-        saveCookie(visitorId);
-        }
-    }, 1000);
-    }
-
-    })('244586c2-5138-4af9-6ec1-a39cdd9d974d');
-</script>
\ No newline at end of file
+{{!-- add supplemental scripts as needed --}}
\ No newline at end of file
diff --git a/project/Dependencies.scala b/project/Dependencies.scala
index 9e8ccfb18..9c1e30f3f 100644
--- a/project/Dependencies.scala
+++ b/project/Dependencies.scala
@@ -8,7 +8,7 @@ object Dependencies {
     val ProtocolVersionMinor = 1
     val RuntimeImage = "gcr.io/kalix-public/kalix-runtime"
     // Remember to bump kalix-runtime.version in akka-javasdk-maven/akka-javasdk-parent if bumping this
-    val RuntimeVersion = sys.props.getOrElse("kalix-runtime.version", "1.2.2")
+    val RuntimeVersion = sys.props.getOrElse("kalix-runtime.version", "1.2.5")
   }
   // NOTE: embedded SDK should have the AkkaVersion aligned, when updating RuntimeVersion, make sure to check
   // if AkkaVersion and AkkaHttpVersion are aligned