diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index dfddc44b4..3f78e3277 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -8,8 +8,7 @@ name: Build
 on:
   push:
     branches:
-      # - main
-      - "release/**"
+      - main
     tags:
       - "letro-v*"
 
@@ -309,24 +308,39 @@ jobs:
 
   release:
     name: Release
-    if: false
-    # if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/letro-v')
     runs-on: ubuntu-24.04
     needs:
-      - assemble-archives
       - build-image
+
+    permissions:
+      contents: write
+
     steps:
-      - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v8
+      - name: Checkout the code (full history for diff)
+        uses: actions/checkout@v6
         with:
-          pattern: mas-cli-*
-          path: artifacts
-          merge-multiple: true
+          fetch-depth: 0
+
+      - name: Read upstream commit from UPSTREAM_VERSION
+        id: upstream
+        run: |
+          echo "commit=$(grep '^commit:' UPSTREAM_VERSION | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Fetch upstream commit
+        run: git fetch origin "${{ steps.upstream.outputs.commit }}" || git fetch https://github.com/element-hq/matrix-authentication-service.git "${{ steps.upstream.outputs.commit }}"
+
+      - name: Generate git diff from upstream
+        run: |
+          git diff "${{ steps.upstream.outputs.commit }}" HEAD -- \
+            ':!LETRO_VERSION' ':!FORK_DIVERGANCE.md' ':!UPSTREAM_VERSION' \
+            > fork-changes.diff
 
       - name: Prepare a release
         uses: softprops/action-gh-release@v2.6.1
         with:
           generate_release_notes: true
+          prerelease: ${{ contains(github.ref_name, '-rc.') }}
           body: |
             ### Docker image
 
@@ -355,17 +369,15 @@ jobs:
                 ```
 
           files: |
-            artifacts/mas-cli-x86_64-linux.tar.gz
-          draft: true
+            fork-changes.diff
+            FORK_DIVERGANCE.md
 
   unstable:
     name: Update the unstable release
-    if: false
-    # if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-24.04
 
     needs:
-      - assemble-archives
       - build-image
 
     permissions:
@@ -378,13 +390,6 @@ jobs:
           sparse-checkout: |
             .github/scripts
 
-      - name: Download the artifacts from the previous job
-        uses: actions/download-artifact@v8
-        with:
-          pattern: mas-cli-*
-          path: artifacts
-          merge-multiple: true
-
       - name: Update unstable git tag
         uses: actions/github-script@v8.0.0
         with:
@@ -431,8 +436,6 @@ jobs:
                 ') }}
                 ```
 
-          files: |
-            artifacts/mas-cli-x86_64-linux.tar.gz
           prerelease: true
           make_latest: false
 
diff --git a/.github/workflows/release-branch.yaml b/.github/workflows/release-branch.yaml
index 528ec8e55..c0ec8b117 100644
--- a/.github/workflows/release-branch.yaml
+++ b/.github/workflows/release-branch.yaml
@@ -106,6 +106,7 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
         with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
           sparse-checkout: |
             .github/scripts
 
diff --git a/.github/workflows/release-bump.yaml b/.github/workflows/release-bump.yaml
index 06d540daa..01f164785 100644
--- a/.github/workflows/release-bump.yaml
+++ b/.github/workflows/release-bump.yaml
@@ -75,6 +75,7 @@ jobs:
       - name: Checkout the code
         uses: actions/checkout@v6
         with:
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
           sparse-checkout: |
             .github/scripts