diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 6aeefa8..1e591c0 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -1,41 +1,38 @@
-name: ci
+name: CI
 
 on:
   push:
     branches: [main]
   pull_request:
+    branches: [main]
 
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+env:
+  REGISTRY: forgejo.riotpiao.com
+  IMAGE: forgejo.riotpiao.com/rock/kmsvc-sdk
 
 jobs:
   test:
+    name: Test
     runs-on: golang
-    container:
-      image: golang:1.26
-    env:
-      GOPRIVATE: forgejo.riotpiao.com
-      GOFLAGS: -mod=readonly
-      REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
     steps:
-      # actions/checkout is a Node-based action; install node for Actions support.
-      - name: install node (required by JS-based actions)
-        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git
+      - name: Install Node.js for actions runtime
+        run: apt-get update && apt-get install -y nodejs
 
-      - uses: actions/checkout@v4
+      - name: Checkout code
+        uses: actions/checkout@v4
 
-      # kmsvc-proto lives in another private repo on the same Forgejo instance.
-      - name: configure git auth for private module fetch
+      - name: Configure git auth for private modules
         run: |
           git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
 
       - name: gofmt
         run: |
           fmt_out="$(gofmt -l .)"
           if [ -n "$fmt_out" ]; then
             echo "$fmt_out"
-            echo "::error::gofmt found unformatted files, run 'gofmt -w .'"
+            echo "::error::gofmt found unformatted files"
             exit 1
           fi
 
@@ -50,3 +47,61 @@ jobs:
 
       - name: coverage summary
         run: go tool cover -func=coverage.out | tail -1
+
+  release:
+    name: Create Release (on tag)
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: golang
+    permissions:
+      contents: write
+    steps:
+      - name: Install Node.js
+        run: apt-get update && apt-get install -y nodejs
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Configure git auth
+        run: |
+          git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
+        env:
+          REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
+
+      - name: Run gate (vet, build, test)
+        run: |
+          go vet ./...
+          go build ./...
+          go test ./... -race
+
+      - name: Extract changelog
+        id: changelog
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          version="${tag#v}"
+          notes="$(awk -v ver="$version" '
+            $0 ~ "^## v"ver"([^.0-9]|$)" { found=1; next }
+            found && /^## / { exit }
+            found { print }
+          ' CHANGELOG.md)"
+          if [ -z "$notes" ]; then
+            notes="(no changelog entry found for $tag)"
+          fi
+          {
+            echo "notes<<EOF"
+            echo "$notes"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Create Forgejo release
+        run: |
+          curl -fsSL -X POST \
+            -H "Authorization: token ${FORGEJO_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases" \
+            -d "$(jq -n \
+                  --arg tag "$GITHUB_REF_NAME" \
+                  --arg body "${{ steps.changelog.outputs.notes }}" \
+                  '{tag_name: $tag, name: $tag, body: $body, draft: false, prerelease: false}')" \
+            | jq .
+        env:
+          FORGEJO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
deleted file mode 100644
index 88e38c8..0000000
--- a/.gitea/workflows/release.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: release
-
-on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
-
-permissions:
-  contents: write
-
-jobs:
-  release:
-    runs-on: golang
-    container:
-      image: golang:1.26
-    env:
-      GOPRIVATE: forgejo.riotpiao.com
-    steps:
-      - name: install node + curl + jq (required by JS-based actions / release API call)
-        run: apt-get update && apt-get install -y --no-install-recommends nodejs ca-certificates git curl jq
-
-      - uses: actions/checkout@v4
-
-      - name: configure git auth for private module fetch
-        run: |
-          git config --global url."https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com".insteadOf "https://forgejo.riotpiao.com"
-        env:
-          REGISTRY_PAT: ${{ secrets.GITHUB_TOKEN }}
-
-      # A tag is the public contract for `go get ...@vX.Y.Z` — re-run the full
-      # gate before publishing a release, never trust that main was green.
-      - name: go vet
-        run: go vet ./...
-
-      - name: go build
-        run: go build ./...
-
-      - name: go test
-        run: go test ./... -race
-
-      - name: extract changelog section
-        id: changelog
-        run: |
-          tag="${GITHUB_REF_NAME}"
-          version="${tag#v}"
-          notes="$(awk -v ver="$version" '
-            $0 ~ "^## v"ver"([^.0-9]|$)" { found=1; next }
-            found && /^## / { exit }
-            found { print }
-          ' CHANGELOG.md)"
-          if [ -z "$notes" ]; then
-            notes="(no changelog entry found for $tag)"
-          fi
-          {
-            echo "notes<<EOF"
-            echo "$notes"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: create forgejo release
-        run: |
-          curl -fsSL -X POST \
-            -H "Authorization: token ${FORGEJO_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases" \
-            -d "$(jq -n \
-                  --arg tag "$GITHUB_REF_NAME" \
-                  --arg body "${{ steps.changelog.outputs.notes }}" \
-                  '{tag_name: $tag, name: $tag, body: $body, draft: false, prerelease: false}')"
-        env:
-          FORGEJO_TOKEN: ${{ secrets.GITHUB_TOKEN }}