diff --git a/.github/.release-please-manifest.json b/.github/.release-please-manifest.json
new file mode 100644
index 000000000..2a266f81f
--- /dev/null
+++ b/.github/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "3.7.0"
+}
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 000000000..f8a5d9c9e
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,16 @@
+# Fluent Operator Code Owners
+# ----------------------
+# The following file list the code owners or responsibles for code
+# review on different components or extensions of Fluent Bit, applicable for
+# any original code author (not only maintainers).
+#
+# NOTE: if you are a original code author and you are not listed here, please
+# open a PR with the proper modification :)
+
+# CI
+# ------------------------------------
+/.github/ @joshuabaird @benjaminhuo @cw-Guo @marcofranssen @wanjunlei
+
+# CODEOWNERS
+# ------------------------------------
+.github/CODEOWNERS  @joshuabaird @benjaminhuo @cw-Guo @marcofranssen @wanjunlei
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 30d38db80..3d144c48f 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,3 +1,8 @@
+<!--
+PR titles must follow Conventional Commits format: https://www.conventionalcommits.org
+Examples: feat: add X | fix: correct Y | chore: update Z | docs: improve W
+-->
+
 <!--
 Thank you for contributing to Fluent Operator!
 Your commits need to follow DCO: https://probot.github.io/apps/dco/
diff --git a/.github/release-please-config.json b/.github/release-please-config.json
new file mode 100644
index 000000000..bd20e761a
--- /dev/null
+++ b/.github/release-please-config.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "simple",
+  "extra-files": [
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    },
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator-fluent-bit-crds/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    },
+    {
+      "type": "yaml",
+      "path": "charts/fluent-operator-fluentd-crds/Chart.yaml",
+      "jsonpath": "$.appVersion"
+    }
+  ]
+}
diff --git a/.github/workflows/build-fluentbit-image.yaml b/.github/workflows/build-fluentbit-image.yaml
index be40fc6ed..9f518a0a8 100644
--- a/.github/workflows/build-fluentbit-image.yaml
+++ b/.github/workflows/build-fluentbit-image.yaml
@@ -37,9 +37,9 @@ jobs:
         run: |
           VERSION=$(cat cmd/fluent-watcher/fluentbit/VERSION)  # Read the version from the VERSION file
           VERSION_WITHOUT_V=${VERSION#v}
-          MAJOR_MINOR=$(echo $VERSION_WITHOUT_V | cut -d. -f1-2)
+          MAJOR_MINOR=$(echo "$VERSION_WITHOUT_V" | cut -d. -f1-2)
 
-          if skopeo inspect docker://${{ env.GHCR_REPO }}:${VERSION}; then
+          if skopeo inspect "docker://${{ env.GHCR_REPO }}:${VERSION}"; then
             echo "${VERSION} tag already exists, assuming we're building a patch release!"
             LATEST_PATCH_VERSION=$(skopeo list-tags docker://${{ env.GHCR_REPO }} | grep -E "${VERSION}-[0-9]+" | sort | uniq | tail -1 | tr -d \" | cut -d'-' -f2 | tr -d ',')
             NEW_PATCH_VERSION=$((LATEST_PATCH_VERSION + 1))
@@ -50,9 +50,11 @@ jobs:
             IMAGE_BASE_TAG="${VERSION}"
           fi
 
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "image-base-tag=$IMAGE_BASE_TAG" >> $GITHUB_OUTPUT
-          echo "image-major-minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
+          {
+            echo "version=$VERSION"
+            echo "image-base-tag=$IMAGE_BASE_TAG"
+            echo "image-major-minor=$MAJOR_MINOR"
+          } >> "$GITHUB_OUTPUT"
 
   build-tags:
     name: Get image tags
@@ -157,7 +159,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" or "linux/arm64" to just amd64 or arm64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   build-debug:
     name: Build/push debug image (${{ matrix.platform }})
@@ -219,7 +221,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifests
diff --git a/.github/workflows/build-fluentd-image.yaml b/.github/workflows/build-fluentd-image.yaml
index 1cea71291..b9d15dfc6 100644
--- a/.github/workflows/build-fluentd-image.yaml
+++ b/.github/workflows/build-fluentd-image.yaml
@@ -27,7 +27,7 @@ jobs:
         id: get-version
         run: |
           VERSION=$(cat cmd/fluent-watcher/fluentd/VERSION)
-          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
+          echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
 
   determine-tags:
     needs: [get-version]
@@ -43,9 +43,9 @@ jobs:
         run: |
           VERSION=${{ needs.get-version.outputs.VERSION }}
           VERSION_WITHOUT_V=${VERSION#v}
-          MAJOR_MINOR=$(echo $VERSION_WITHOUT_V | cut -d. -f1-2)
+          MAJOR_MINOR=$(echo "$VERSION_WITHOUT_V" | cut -d. -f1-2)
 
-          if skopeo inspect docker://${{ env.GHCR_REPO }}:${VERSION}; then
+          if skopeo inspect "docker://${{ env.GHCR_REPO }}:${VERSION}"; then
             echo "${VERSION} tag already exists, assuming we're building a patch release!"
             LATEST_PATCH_VERSION=$(skopeo list-tags docker://${{ env.GHCR_REPO }} | grep -E "${VERSION}-[0-9]+" | sort | uniq | tail -1 | tr -d \" | cut -d'-' -f2 | tr -d ',')
             NEW_PATCH_VERSION=$((LATEST_PATCH_VERSION + 1))
@@ -56,8 +56,10 @@ jobs:
             IMAGE_BASE_TAG="${VERSION}"
           fi
 
-          echo "IMAGE_BASE_TAG=$IMAGE_BASE_TAG" >> $GITHUB_OUTPUT
-          echo "IMAGE_MAJOR_MINOR=$MAJOR_MINOR" >> $GITHUB_OUTPUT
+          {
+            echo "IMAGE_BASE_TAG=$IMAGE_BASE_TAG"
+            echo "IMAGE_MAJOR_MINOR=$MAJOR_MINOR"
+          } >> "$GITHUB_OUTPUT"
 
   build:
     name: Build/push image (${{ matrix.platform }})
@@ -145,7 +147,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifest
diff --git a/.github/workflows/build-op-image.yaml b/.github/workflows/build-op-image.yaml
index 9c7bed515..0a575b44d 100644
--- a/.github/workflows/build-op-image.yaml
+++ b/.github/workflows/build-op-image.yaml
@@ -157,7 +157,7 @@ jobs:
           platform="${{ matrix.platform }}"
           # Convert "linux/amd64" to just amd64 for the output variable name
           arch=${platform#linux/}
-          echo "${arch}=${{ steps.build.outputs.digest }}" >> $GITHUB_OUTPUT
+          echo "${arch}=${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
 
   manifest:
     name: Publish image manifest
diff --git a/.github/workflows/bump-fluent-bit-version.yaml b/.github/workflows/bump-fluent-bit-version.yaml
index 1ee8fb951..de7f4c525 100644
--- a/.github/workflows/bump-fluent-bit-version.yaml
+++ b/.github/workflows/bump-fluent-bit-version.yaml
@@ -43,8 +43,7 @@ jobs:
 
       - name: Update version in VERSION file
         run: |
-          echo ${{ github.event.inputs.version }} > cmd/fluent-watcher/fluentbit/VERSION
-          if [ $? -ne 0 ]; then
+          if ! echo "${{ github.event.inputs.version }}" > cmd/fluent-watcher/fluentbit/VERSION; then
             echo "Failed to update VERSION file"
             exit 1
           fi
@@ -60,8 +59,7 @@ jobs:
             "manifests/regex-parser/fluentbit-fluentBit.yaml"
           )
           for file in "${files[@]}"; do
-            sed -i 's|image: ghcr.io/fluent/fluent-operator/fluent-bit:.*|image: ghcr.io/fluent/fluent-operator/fluent-bit:${{ github.event.inputs.version }}|' "$file"
-            if [ $? -ne 0 ]; then
+            if ! sed -i 's|image: ghcr.io/fluent/fluent-operator/fluent-bit:.*|image: ghcr.io/fluent/fluent-operator/fluent-bit:${{ github.event.inputs.version }}|' "$file"; then
               echo "Failed to update $file"
               exit 1
             fi
@@ -69,8 +67,7 @@ jobs:
 
       - name: Update version in values.yaml
         run: |
-          sed -i '/repository: "ghcr.io\/fluent\/fluent-operator\/fluent-bit"/!b;n;s/tag: .*/tag: "${{ github.event.inputs.version }}"/' charts/fluent-operator/values.yaml
-          if [ $? -ne 0 ]; then
+          if ! sed -i '/repository: "ghcr.io\/fluent\/fluent-operator\/fluent-bit"/!b;n;s/tag: .*/tag: "${{ github.event.inputs.version }}"/' charts/fluent-operator/values.yaml; then
             echo "Failed to update values.yaml"
             exit 1
           fi
diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
index 51d0e82c5..832b7a802 100644
--- a/.github/workflows/lint-test.yaml
+++ b/.github/workflows/lint-test.yaml
@@ -24,7 +24,7 @@ jobs:
         run: |
           changed=$(ct list-changed --chart-dirs charts/fluent-operator --config .github/ct.yaml)
           if [[ -n "$changed" ]]; then
-            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Run chart-testing (lint)
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 416150c0b..fd4d536fc 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -4,10 +4,14 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
   lint:
     name: Run on Ubuntu
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Clone the code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -21,3 +25,15 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: v2.11.4
+
+  actionlint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index de29bc1b7..6a8368ed6 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -73,7 +73,8 @@ jobs:
 
       - name: Go mod
         run: |
-          export PATH=$PATH:$(go env GOPATH)/bin
+          GOPATH=$(go env GOPATH)
+          export PATH="$PATH:$GOPATH/bin"
           go mod download
 
       - name: Install kubebuilder
@@ -134,22 +135,3 @@ jobs:
 
       - name: Run build all binaries
         run: make binary
-
-  # docker-build:
-  #   runs-on: ubuntu-22.04
-  #   timeout-minutes: 30
-  #   name: Docker amd64 build
-  #   steps:
-  #     - name: Checkout code
-  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-  #       with:
-  #         fetch-depth: 0
-
-  #     - name: Install Go
-  #       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-  #       with:
-  #         go-version-file: go.mod
-  #         cache-dependency-path: go.sum
-
-  #     - name: Run docker build
-  #       run: make build-amd64
diff --git a/.github/workflows/pr-title-lint.yaml b/.github/workflows/pr-title-lint.yaml
new file mode 100644
index 000000000..7fb2cd919
--- /dev/null
+++ b/.github/workflows/pr-title-lint.yaml
@@ -0,0 +1,54 @@
+name: Lint PR Title
+
+on:
+  # This workflow uses pull_request_target because it needs "pull_request: write" to
+  # post comments (not possible with pull_request).
+  #
+  # WARNING!
+  # We MUST ensure that code is NEVER checked out (eg, actions/checkout) in this
+  # workflow, otherwise it opens up a path for attacker-controlled PR code execution!
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - edited
+
+permissions: {}
+
+jobs:
+  lint:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        id: lint_pr_title
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: always() && (steps.lint_pr_title.outputs.error_message != null)
+        with:
+          header: pr-title-lint-error
+          message: |
+            Thank you for your pull request! :wave:
+
+            Your PR title needs to follow the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format so it can be included correctly in the changelog.
+
+            **Examples of valid titles:**
+            - `feat: add support for new filter plugin`
+            - `fix: correct nil pointer in controller reconcile`
+            - `chore: update dependencies`
+            - `docs: improve installation guide`
+
+            **Details:**
+            ```
+            ${{ steps.lint_pr_title.outputs.error_message }}
+            ```
+
+      - uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+        if: ${{ steps.lint_pr_title.outputs.error_message == null }}
+        with:
+          header: pr-title-lint-error
+          delete: true
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
new file mode 100644
index 000000000..ace50dd7f
--- /dev/null
+++ b/.github/workflows/release-please.yaml
@@ -0,0 +1,27 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+    inputs:
+      release-as:
+        description: 'Override the next release version (e.g. 3.8.0). Leave empty for automatic versioning from conventional commits.'
+        required: false
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: .github/release-please-config.json
+          manifest-file: .github/.release-please-manifest.json
+          release-as: ${{ inputs.release-as }}
diff --git a/.github/workflows/release-tool.yaml b/.github/workflows/release-tool.yaml
deleted file mode 100644
index fa9369119..000000000
--- a/.github/workflows/release-tool.yaml
+++ /dev/null
@@ -1,136 +0,0 @@
-name: Create Release Pull Request
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'New version number (e.g., v2.2.0)'
-        required: true
-        type: string
-
-jobs:
-  validate-and-prepare:
-    name: Validate Version and Prepare Variables
-    runs-on: ubuntu-latest
-    outputs:
-      release_branch: ${{ steps.set-branch.outputs.branch }}
-      version_without_v: ${{ steps.set-version.outputs.version }}
-    steps:
-      - name: Validate version format
-        run: |
-          if ! [[ ${{ github.event.inputs.version }} =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Invalid version format. Please use vX.Y.Z"
-            exit 1
-          fi
-
-      - name: Set version without 'v' prefix
-        id: set-version
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION_WITHOUT_V="${VERSION#v}"
-          echo "version=${VERSION_WITHOUT_V}" >> $GITHUB_OUTPUT
-
-      - name: Set branch name
-        id: set-branch
-        run: |
-          VERSION="${{ github.event.inputs.version }}"
-          VERSION_WITHOUT_V="${VERSION#v}"
-          if [[ $VERSION_WITHOUT_V =~ ^([0-9]+\.[0-9]+)\.0$ ]]; then
-            # If version ends with .0, use X.Y format
-            BRANCH="release-${BASH_REMATCH[1]}"
-          else
-            # Otherwise use full X.Y.Z format
-            BRANCH="release-${VERSION_WITHOUT_V}"
-          fi
-          echo "branch=${BRANCH}" >> $GITHUB_OUTPUT
-
-  create-branches:
-    name: Create Release Branches
-    needs: validate-and-prepare
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Configure Git
-        run: |
-          git config user.name "GitHub Actions Bot"
-          git config user.email "actions@github.com"
-
-      - name: Create target release branch
-        run: |
-          git checkout -b ${{ needs.validate-and-prepare.outputs.release_branch }}
-          git push --set-upstream origin ${{ needs.validate-and-prepare.outputs.release_branch }}
-
-      - name: Create work branch
-        run: |
-          git checkout -b ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-          git push --set-upstream origin ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-
-  update-versions:
-    name: Update Version References
-    needs: [validate-and-prepare, create-branches]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-
-      - name: Configure Git
-        run: |
-          git config user.name "GitHub Actions Bot"
-          git config user.email "actions@github.com"
-
-      - name: Update manifest files
-        run: |
-          # Update deployment manifests
-          files=(
-            "manifests/setup/fluent-operator-deployment.yaml"
-            "manifests/setup/setup.yaml"
-          )
-          for file in "${files[@]}"; do
-            if [ -f "$file" ]; then
-              sed -i 's/fluent-operator:latest/fluent-operator:v${{ needs.validate-and-prepare.outputs.version_without_v }}/' "$file"
-            else
-              echo "Warning: File $file not found"
-              exit 1
-            fi
-          done
-
-      - name: Update Helm chart values
-        run: |
-          if [ -f "charts/fluent-operator/values.yaml" ]; then
-            sed -i '/repository: "kubesphere\/fluent-operator"/!b;n;s/tag: "latest"/tag: "v${{ needs.validate-and-prepare.outputs.version_without_v }}"/' charts/fluent-operator/values.yaml
-          else
-            echo "Error: values.yaml not found"
-            exit 1
-          fi
-
-      - name: Update VERSION file
-        run: |
-          echo "v${{ needs.validate-and-prepare.outputs.version_without_v }}" > VERSION
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
-        with:
-          commit-message: "Bump version to v${{ needs.validate-and-prepare.outputs.version_without_v }}"
-          signoff: true
-          title: "Release v${{ needs.validate-and-prepare.outputs.version_without_v }}"
-          body: |
-            ## Release v${{ needs.validate-and-prepare.outputs.version_without_v }}
-
-            This PR updates version references for the v${{ needs.validate-and-prepare.outputs.version_without_v }} release.
-
-            ### Changes
-            The following files have been updated:
-            - manifests/setup/fluent-operator-deployment.yaml
-            - manifests/setup/setup.yaml
-            - charts/fluent-operator/values.yaml
-            - VERSION
-
-            Please review the changes carefully before merging.
-          branch: ${{ needs.validate-and-prepare.outputs.release_branch }}-work
-          base: ${{ needs.validate-and-prepare.outputs.release_branch }}
-          labels: |
-            release
diff --git a/.github/workflows/upload-release-assets.yaml b/.github/workflows/upload-release-assets.yaml
new file mode 100644
index 000000000..c2663ded3
--- /dev/null
+++ b/.github/workflows/upload-release-assets.yaml
@@ -0,0 +1,33 @@
+name: Upload Release Assets
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  upload-assets:
+    name: Upload setup.yaml
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.release.tag_name }}
+
+      - name: Read version
+        id: version
+        run: echo "version=$(cat version.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Stamp image tag in setup.yaml
+        run: |
+          sed -i \
+            's|ghcr.io/fluent/fluent-operator/fluent-operator:latest|ghcr.io/fluent/fluent-operator/fluent-operator:v${{ steps.version.outputs.version }}|g' \
+            manifests/setup/setup.yaml
+
+      - name: Upload setup.yaml to release
+        run: gh release upload "${{ github.event.release.tag_name }}" manifests/setup/setup.yaml --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Makefile b/Makefile
index fbce96dee..7c5e5d465 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ MAKEFLAGS = --warn-undefined-variables
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
-VERSION ?= $(shell cat VERSION | tr -d " \t\n\r")
+VERSION ?= $(shell cat version.txt | tr -d " \t\n\r")
 FB_VERSION?=$(shell grep -v '^#' cmd/fluent-watcher/fluentbit/VERSION | tr -d " \t\n\r")
 # Image URL to use all building/pushing image targets
 FB_IMG ?= ghcr.io/fluent/fluent-operator/fluent-bit:v${FB_VERSION}
diff --git a/README.md b/README.md
index 5f132a46c..71826df73 100644
--- a/README.md
+++ b/README.md
@@ -133,9 +133,9 @@ Kubernetes v1.16.13+ is necessary for running Fluent Operator.
 Install the latest stable version
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/release-3.7/manifests/setup/setup.yaml
+kubectl apply -f https://github.com/fluent/fluent-operator/releases/latest/download/setup.yaml
 
-# You can change the namespace in manifests/setup/kustomization.yaml in corresponding release branch
+# You can change the namespace in manifests/setup/kustomization.yaml
 # and then use command below to install to another namespace
 # kubectl kustomize manifests/setup/ | kubectl apply -f -
 ```
@@ -143,7 +143,7 @@ kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/releas
 Install the development version
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/fluent/fluentbit-operator/master/manifests/setup/setup.yaml
+kubectl apply -f https://raw.githubusercontent.com/fluent/fluent-operator/master/manifests/setup/setup.yaml
 
 # You can change the namespace in manifests/setup/kustomization.yaml
 # and then use command below to install to another namespace
diff --git a/RELEASE.md b/RELEASE.md
index 358253188..719f90341 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -51,106 +51,64 @@ This page describes the release process and the currently planned schedule for u
 | v3.6.0         | 2025-10-24            | Josh Baird (GitHub: @joshuabaird)       |
 | v3.7.0         | 2026-02-27            | Josh Baird (GitHub: @joshuabaird)       |
 
-
-### How to cut a new release
-
-> This guide is strongly based on the [Prometheus release instructions](https://github.com/prometheus/prometheus/blob/master/RELEASE.md).
-
-### Branch management and versioning strategy
+## Versioning strategy
 
 We use [Semantic Versioning](http://semver.org/).
 
-We maintain a separate branch for each minor release, named `release-<major>.<minor>`, e.g. `release-1.1`, `release-2.0`.
-
-The usual flow is to merge new features and changes into the master branch and to merge bug fixes into the latest release branch. Bug fixes are then merged into master from the latest release branch. The master branch should always contain all commits from the latest release branch.
-
-If a bug fix got accidentally merged into master, cherry-pick commits have to be created in the latest release branch, which then have to be merged back into master. Try to avoid that situation.
-
-Maintaining the release branches for older minor releases happens on a best effort basis.
-
-### Prepare your release
-
-For a new major or minor release, work from the `main` branch. For a patch release, work in the branch of the minor release you want to patch (e.g. `release-0.1` if you're releasing `v0.1.1`).
+Version bumps are driven automatically by [Conventional Commits](https://www.conventionalcommits.org/) in PR titles:
 
-Add an entry for the new version to the `CHANGELOG.md` file. Entries in the `CHANGELOG.md` should be in this order:
+| Commit prefix | Effect |
+|---|---|
+| `feat:` | Minor version bump |
+| `fix:` | Patch version bump |
+| `feat!:` or `BREAKING CHANGE:` | Major version bump |
+| `chore:`, `docs:`, `ci:`, etc. | No version bump (excluded from changelog) |
 
-- `[CHANGE]`
-- `[FEATURE]`
-- `[ENHANCEMENT]`
-- `[BUGFIX]`
+## How to cut a new release
 
-Create a PR for the changes to be reviewed.
+Releases are fully automated via [release-please](https://github.com/googleapis/release-please-action). The only human action required is **merging the Release PR**.
 
-### Publish the new release
+### Minor and major releases
 
-For new minor and major releases, create the `release-<major>.<minor>` branch starting at the PR merge commit.
-From now on, all work happens on the `release-<major>.<minor>` branch.
+1. As PRs merge to `master`, release-please continuously updates a **Release PR** that accumulates the changelog and bumps `version.txt` and all `Chart.yaml` `appVersion` fields.
+2. When you are ready to ship, review the Release PR — edit the changelog body if needed — and merge it.
+3. release-please automatically pushes the git tag and creates the GitHub Release.
+4. The [`build-op-image`](./github/workflows/build-op-image.yaml) workflow fires on the tag and builds and pushes multi-arch operator images to GHCR and Docker Hub.
+5. The [`upload-release-assets`](.github/workflows/upload-release-assets.yaml) workflow fires on the release publication and attaches `setup.yaml` (with the correct image tag stamped in) as a release asset.
 
-Bump the version in the `VERSION` file in the root of the repository.
+To force a specific version instead of the auto-calculated one, dispatch the [Release Please](https://github.com/fluent/fluent-operator/actions/workflows/release-please.yaml) workflow manually with the `release-as` input set to the desired version (e.g. `3.8.0`).
 
-Regenerate setup.yaml based on latest code and then commit the changed bundle.yaml to the `release-<major>.<minor>` branch:
+### Patch releases
 
-```bash
-make manifests
-git add ./
-git commit -s -m "regenerate setup.yaml"
-git push
-```
+For a patch release against an older minor line (e.g. `v3.7.1`):
 
-Images will be automatically built and pushed whenever code changes or a tag is created. If users want to build images manually, use the following command:
+1. Create a `release-3.7` branch from the `v3.7.0` tag if it does not already exist.
+2. Cherry-pick the relevant fix commits onto that branch.
+3. Dispatch the [Release Please](https://github.com/fluent/fluent-operator/actions/workflows/release-please.yaml) workflow targeting the `release-3.7` branch with `release-as: 3.7.1`.
+4. Review and merge the resulting Release PR on the `release-3.7` branch.
+5. Cherry-pick the fix commits back into `master` if they are not already there.
 
-```bash
-make build-op-amd64 -e FO_IMG=<image of fluent operator>
-docker push <image of fluent operator>
-make build-fb-amd64 -e FB_IMG=<image of fluent bit>
-docker push <image of fluent bit>
-make build-fd-amd64 -e FD_IMG=<image of fluentd>
-docker push <image of fluentd>
-```
+### Publish updated Helm chart
 
-Tag the new release with a tag named `v<major>.<minor>.<patch>`, e.g. `v2.1.3`. Note the `v` prefix. You can do the tagging on the commandline:
+The `appVersion` fields in the three chart `Chart.yaml` files in this repo are bumped automatically by the Release PR. After merging the Release PR, the chart still needs to be manually synced to [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/) where users install from:
 
-```bash
-tag="$(< VERSION)"
-git tag -a "${tag}" -m "${tag}"
-git push origin "${tag}"
-```
+- Copy the updated `charts/fluent-operator/` directory to a branch in `fluent/helm-charts`
+- Bump the chart `version` field (separate from `appVersion`) per the helm-charts versioning convention
+- Open a PR in `fluent/helm-charts`
 
-Commit all the changes.
-
-Finally, create a new release:
-
-- Go to https://github.com/fluent/fluent-operator/releases/new.
-- Associate the new release with the previously pushed tag.
-- Add release notes based on `CHANGELOG.md`.
-- Add file `setup.yaml` from `manifests/setup/setup.yaml` and then click "Publish release".
-
-For patch releases, cherry-pick the commits from the release branch into the master branch.
-
-#### Publish updated Helm chart
-
-This repo includes a "development" chart in the [charts/](./charts/fluent-operator/) directory. For each release, this chart must be published to the [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/) repository which is where Fluent Operators install the chart from. This is currently a manual process. Follow these instructions to update and publish the chart:
-
-- Bump `version` and `appVersion` in the [charts/fluent-operator/Chart.yaml](./charts/fluent-operator/Chart.yaml) file in this repo
-- Bump `version` and `appVersion` in the [charts/fluent-operator/charts/fluent-bit-crds/Chart.yaml](./charts/fluent-operator/charts/fluent-bit-crds/Chart.yaml) and [charts/fluent-operator/charts/fluentd-crds/Chart.yaml](./charts/fluent-operator/charts/fluentd-crds/Chart.yaml) directory
-- Bump the `fluent-bit-crds` and `fluentd-crds` version under `dependencies` in [charts/fluent-operator/Chart.yaml](./charts/fluent-operator/Chart.yaml)
-- Manually "sync" (copy, open a PR) the local [chart](./charts/fluent-operator) to [fluent/helm-charts](https://github.com/fluent/helm-charts/tree/main/charts/fluent-operator/)
+Do the same for the `fluent-operator-fluentd-crds` and `fluent-operator-fluent-bit-crds` charts.
 
 ## Fluentd/Fluent-bit Images
 
-Fluent Operator uses [custom builds](./cmd/fluent-watcher/README.md) of both Fluentd and Fluent-bit.  These images can (and often should be) be published out-of-band of Fluent Operator releases.
+Fluent Operator uses [custom builds](./cmd/fluent-watcher/README.md) of both Fluentd and Fluent Bit. These images can (and often should) be published out-of-band of Fluent Operator releases.
 
-### Fluent-bit
+### Fluent Bit
 
-To publish a new fluent-bit image:
-
-* Execute the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow dispatch to generate a PR to update fluent-bit version references in this repo
-* Merge the PR generated by the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow. (This will [automatically trigger the release](https://github.com/fluent/fluent-operator/blob/master/.github/workflows/build-fluentbit-image.yaml#L4-L8) of the new fluent-bit image)
+1. Execute the [bump-fluent-bit-version](https://github.com/fluent/fluent-operator/actions/workflows/bump-fluent-bit-version.yaml) workflow dispatch to generate a PR updating all Fluent Bit version references in this repo.
+2. Merge the PR. This automatically triggers the [build-fluentbit-image](https://github.com/fluent/fluent-operator/actions/workflows/build-fluentbit-image.yaml) workflow which builds and pushes the new image.
 
 ### Fluentd
 
-To publish a new fluentd image:
-
-* Open a PR to update all references of the image/tag in this repo with the new image tag (TODO: automate this like the fluent-bit release process) including the `cmd/fluent-watcher/fluentd/VERSION` file
-* Merge the PR
-* Execute the [publish-fluentd-image](https://github.com/fluent/fluent-operator/actions/workflows/publish-fluentd-image.yaml) workflow dispatch to build and publish the new image
+1. Open a PR updating all references to the image tag in this repo, including `cmd/fluent-watcher/fluentd/VERSION`.
+2. Merge the PR.
+3. Execute the [publish-fluentd-image](https://github.com/fluent/fluent-operator/actions/workflows/publish-fluentd-image.yaml) workflow dispatch to build and push the new image.
diff --git a/VERSION b/VERSION
deleted file mode 100644
index b9bc2fdcb..000000000
--- a/VERSION
+++ /dev/null
@@ -1 +0,0 @@
-latest
\ No newline at end of file
diff --git a/tests/scripts/fluentd_e2e.sh b/tests/scripts/fluentd_e2e.sh
index 81ac8cbe8..36349f772 100755
--- a/tests/scripts/fluentd_e2e.sh
+++ b/tests/scripts/fluentd_e2e.sh
@@ -12,7 +12,7 @@ PROJECT_ROOT="$PWD"
 E2E_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 LOGGING_NAMESPACE="fluent"
 IMAGE_TAG="$(date "+%Y-%m-%d-%H-%M-%S")"
-VERSION="$(tr -d " \t\n\r" < VERSION)"
+VERSION="$(tr -d " \t\n\r" < version.txt)"
 IMAGE_NAME="ghcr.io/fluent/fluent-operator/fluent-operator"
 KIND_CLUSTER="${KIND_CLUSTER:-fluent-operator-test-e2e}"
 
diff --git a/version.txt b/version.txt
new file mode 100644
index 000000000..7c69a55db
--- /dev/null
+++ b/version.txt
@@ -0,0 +1 @@
+3.7.0