diff --git a/.github/rulesets/tag-semver.json b/.github/rulesets/tag-semver.json
new file mode 100644
index 0000000..3b5865f
--- /dev/null
+++ b/.github/rulesets/tag-semver.json
@@ -0,0 +1,18 @@
+{
+  "name": "Protect SemVer release tags",
+  "target": "tag",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/[0-9]+.[0-9]+.[0-9]+"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dc79570..da08efb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: ci
 
 on:
   push:
@@ -14,8 +14,8 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  test:
-    name: test
+  validate:
+    name: static validators
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -24,3 +24,15 @@ jobs:
           persist-credentials: false
       - name: Validate public module
         run: scripts/validate_module.sh
+
+  test:
+    name: test
+    needs: validate
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Preserve required check identity
+        env:
+          VALIDATE_RESULT: ${{ needs.validate.result }}
+        run: test "$VALIDATE_RESULT" = success
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 33957de..57e5381 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b50364e2a415267688c1d845cea6866cdb5e53d6 # 0.1.4
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@1eaaa687f32f81c33ac99be3db0b76d0204420b8 # 0.1.8
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8abd4a6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,70 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Validate exact release identity
+        id: version
+        run: |
+          set -euo pipefail
+          version="$GITHUB_REF_NAME"
+          [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          [ "$(cat VERSION)" = "$version" ]
+          grep -Fxq "## [$version] - 2026-08-25" CHANGELOG.md
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+          printf 'version=%s\n' "$version" >>"$GITHUB_OUTPUT"
+
+  promotion:
+    needs: resolve
+    permissions:
+      actions: read # verify exact public workflow evidence
+      contents: read # read the signed annotated tag
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@1eaaa687f32f81c33ac99be3db0b76d0204420b8 # 0.1.8
+    with:
+      version: ${{ needs.resolve.outputs.version }}
+      runner: ubuntu-latest
+
+  authorize:
+    needs: [resolve, promotion]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: release
+    permissions: {}
+    steps:
+      - run: echo 'protected release authority granted'
+
+  publish:
+    needs: [resolve, promotion, authorize]
+    permissions:
+      contents: write # create the immutable release
+      id-token: write # mint Sigstore identity
+      attestations: write # persist provenance and SBOM attestations
+      artifact-metadata: write # persist attested artifact metadata
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@1eaaa687f32f81c33ac99be3db0b76d0204420b8 # 0.1.8
+    with:
+      version: ${{ needs.resolve.outputs.version }}
+      package_name: cd-workflows
+      archive_paths: 'README.md LICENSE SECURITY.md CONTRIBUTING.md VERSION CHANGELOG.md .github schemas scripts tests'
+      runner: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a7fdb0..56dcb07 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,8 @@ Versioning.
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-08-25
+
 ### Fixed
 
 - `cd-apply` now proves a caller-supplied contract commit is an ancestor of
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..17e51c3
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+0.1.1
diff --git a/catalog/actions.yml b/catalog/actions.yml
index b569bba..86f0139 100644
--- a/catalog/actions.yml
+++ b/catalog/actions.yml
@@ -21,5 +21,11 @@ actions:
     sha: "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     version: "v7.0.1"
   - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml
-    sha: "b50364e2a415267688c1d845cea6866cdb5e53d6"
-    version: "0.1.4"
+    sha: "1eaaa687f32f81c33ac99be3db0b76d0204420b8"
+    version: "0.1.8"
+  - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml
+    sha: "1eaaa687f32f81c33ac99be3db0b76d0204420b8"
+    version: "0.1.8"
+  - name: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml
+    sha: "1eaaa687f32f81c33ac99be3db0b76d0204420b8"
+    version: "0.1.8"