diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000..b1738cd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,2 @@
+self-hosted-runner:
+  labels: [hetzner]
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 4d00e00..c7bda97 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -9,4 +9,4 @@ name: Pre-commit
 
 jobs:
   pre-commit:
-    uses: Baker-scripts/.github/.github/workflows/pre-commit.yml@2e5b5141c1f6e8ea3e7dbc5f6dc0b07ffb7b8222 # main
+    uses: Baker-scripts/.github/.github/workflows/pre-commit.yml@3c1f3173b20fba4832b50116a455be4fc85a2ebc # main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..cc18407
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,26 @@
+---
+name: Release
+
+"on":
+  workflow_run:
+    workflows: [Pre-commit, ShellCheck]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Release
+    if: >-
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      contents: write
+      actions: read
+    uses: bakerboy448/.github/.github/workflows/release-calver-gated.yml@3f32d193e96c22760f874cc5ae35e0f072e0a173
+    with:
+      sha: ${{ github.event.workflow_run.head_sha }}
+      required_workflows: pre-commit.yml
+      optional_workflows: shellcheck.yml
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 00159f3..479a1ff 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,7 +16,7 @@ permissions:
 jobs:
   shellcheck:
     name: Run ShellCheck
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, Linux, X64, hetzner]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7