diff --git a/.github/workflows/build-and-upload.yml b/.github/workflows/build-and-upload.yml
deleted file mode 100644
index 3560bfd..0000000
--- a/.github/workflows/build-and-upload.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: Build and Upload Artifacts
-
-on:
-  workflow_call:
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          # 'latest', 'nightly', or a semver
-          version: '~> v2'
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Install gooci cli
-        run: go install github.com/compliance-framework/gooci@latest
-      - name: Authenticate gooci cli
-        run: gooci login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }}
-      - name: gooci Upload Version
-        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{github.ref_name}} --annotate="org.ccf.plugin.protocol.version=2"
-      - name: gooci Upload Latest
-        if: "!github.event.release.prerelease"
-        run: gooci upload dist/ ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest --annotate="org.ccf.plugin.protocol.version=2"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1c33d45..4277a73 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   ci:
-    uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/ci-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     permissions:
       actions: read
       contents: read
@@ -21,14 +21,14 @@ jobs:
     secrets: inherit
 
   release-checks:
-    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/release-checks.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     permissions:
       contents: read
 
   notify:
     needs: [ci, release-checks]
     if: always()
-    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@7b55019ed36050a57eb8273f6a67fd4b2395adb0 # v1.5.1
+    uses: compliance-framework/workflows/.github/workflows/notify-failure.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
     with:
       needs: ${{ toJSON(needs) }}
     permissions:
diff --git a/.github/workflows/cut-prerelease.yml b/.github/workflows/cut-prerelease.yml
new file mode 100644
index 0000000..2871014
--- /dev/null
+++ b/.github/workflows/cut-prerelease.yml
@@ -0,0 +1,11 @@
+name: cut-prerelease
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  cut:
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    permissions:
+      contents: read
+    secrets: inherit
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
new file mode 100644
index 0000000..6ed453c
--- /dev/null
+++ b/.github/workflows/preview.yml
@@ -0,0 +1,26 @@
+# Publishes :pr-<number> previews for PRs labelled `preview` (no :main previews for plugins).
+name: preview
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  # A merged PR's events carry the base branch as github.ref, so key PR runs by number.
+  group: preview-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  preview:
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    with:
+      kind: go-plugin
+      on-main: false
+    permissions:
+      contents: read
+      packages: write
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..4ef3bb3
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,19 @@
+# Opens/updates the release PR and, once it merges, tags and publishes the release.
+name: release-please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-please
+
+jobs:
+  release-please:
+    uses: compliance-framework/workflows/.github/workflows/release-please.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    permissions:
+      contents: read
+    secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a50955..f566899 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,19 @@
-name: New Release
+# Publishes the plugin (goreleaser archives + gooci upload) when a release is published.
+name: release
 
 on:
-  push:
-    tags:
-      - '*'
+  release:
+    types: [published]
+
+permissions:
+  contents: read
 
 jobs:
   release:
+    uses: compliance-framework/workflows/.github/workflows/release-go-plugin.yml@6e7fc9c04b59c7d1117938da397f8a6f8df036ab # v1.5.2
+    with:
+      protocol-version: "2"
     permissions:
+      contents: write # goreleaser attaches the archives to the release
       packages: write
-      contents: write
-    uses: ./.github/workflows/build-and-upload.yml
+    secrets: inherit
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index c4ef88a..748835b 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -34,6 +34,10 @@ archives:
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
 
+release:
+  prerelease: auto
+  replace_existing_artifacts: true
+
 changelog:
   sort: asc
   filters:
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..2537c1f
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "0.4.0"
+}
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..9efa578
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "initial-version": "0.1.0",
+  "changelog-sections": [
+    { "type": "feat", "section": "Features" },
+    { "type": "fix", "section": "Bug Fixes" },
+    { "type": "perf", "section": "Performance Improvements" },
+    { "type": "revert", "section": "Reverts" },
+    { "type": "deps", "section": "Dependencies" },
+    { "type": "chore", "section": "Miscellaneous Chores", "hidden": true },
+    { "type": "ci", "section": "Continuous Integration", "hidden": true },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+    { "type": "build", "section": "Build System", "hidden": true }
+  ],
+  "packages": {
+    ".": { "release-type": "go" }
+  }
+}