diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5eac50f..e5a5af8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.22'
       - name: golangci-lint
@@ -31,9 +31,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.22'
       - name: Run tests
@@ -46,9 +46,9 @@ jobs:
   benchmark:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.22'
       - name: Run benchmarks
@@ -74,9 +74,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.22'
       - name: Build binary
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index da6d7f3..3d13a0d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,9 +15,15 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+      - name: Ensure release commit is tagged
+        run: |
+          if ! git describe --exact-match --tags HEAD >/dev/null 2>&1; then
+            echo "::error::No tag at HEAD. Cut releases with the 'Tag Release' workflow; running 'Release' directly only works at a tag ref."
+            exit 1
+          fi
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: '1.22'
       - name: Run Tests
@@ -31,7 +37,7 @@ jobs:
           go install ./cmd/sysgreet
           sysgreet --disable
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
+        uses: goreleaser/goreleaser-action@v6
         with:
           version: "~> v2"
           args: release --clean
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 5b63ee3..cec74ec 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -20,7 +20,7 @@ jobs:
   tag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: main
           fetch-depth: 0
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 36af6ae..9d60196 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,3 +1,5 @@
+version: 2
+
 project_name: sysgreet
 
 before:
@@ -19,8 +21,8 @@ builds:
 
 archives:
   - id: binary
-    builds: [sysgreet]
-    format: tar.gz
+    ids: [sysgreet]
+    formats: [tar.gz]
     files:
       - LICENSE
       - README.md