diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b4b8da451..7785b23aa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,18 +5,67 @@ on:
     branches:
       - main
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 permissions:
   id-token: write  # Required for OIDC. See https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow
   contents: read
 
 jobs:
+  release-decision:
+    runs-on: ubuntu-latest
+    outputs:
+      should-release: ${{ steps.decision.outputs.should-release }}
+    steps:
+      - name: Decide release
+        id: decision
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMITTER_EMAIL: ${{ github.event.head_commit.committer.email }}
+          COMMITTER_NAME: ${{ github.event.head_commit.committer.name }}
+          COMMIT_SHA: ${{ github.sha }}
+        shell: bash
+        run: |
+          echo "Commit: $COMMIT_SHA"
+          echo "Committer: $COMMITTER_NAME <$COMMITTER_EMAIL>"
+
+          # Skip if commit is from release bot (avoid infinite loop)
+          if [[ "$COMMITTER_EMAIL" == 'release-bot@opentermsarchive.org' ]]; then
+            echo "→ Skipping: commit is from release bot"
+            echo "should-release=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Check if commit comes from a PR merged to main
+          PR_JSON=$(gh pr list \
+            --repo "${{ github.repository }}" \
+            --search "$COMMIT_SHA is:merged base:main" \
+            --state merged \
+            --json number,title,url)
+
+          PR_COUNT=$(echo "$PR_JSON" | jq 'length')
+
+          if [[ "$PR_COUNT" -gt 0 ]]; then
+            echo "$PR_JSON" | jq -r '.[] | "→ Found PR #\(.number): \(.title)"'
+            echo "→ Release will proceed"
+            echo "should-release=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "→ No merged PR found for this commit"
+            echo "should-release=false" >> "$GITHUB_OUTPUT"
+          fi
+
   changelog:
+    needs: release-decision
+    if: ${{ needs.release-decision.outputs.should-release == 'true' }}
     uses: "./.github/workflows/changelog.yml"
   test:
+    needs: changelog
+    if: ${{ needs.changelog.outputs.release-type != 'no-release' }}
     uses: "OpenTermsArchive/engine/.github/workflows/test.yml@main"
   release:
-    needs: [ changelog, test ]
-    if: needs.changelog.outputs.release-type != 'no-release'
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -50,8 +99,7 @@ jobs:
           git commit -m "Release v${{ steps.release-changelog.outputs.version }}"
           git tag v${{ steps.release-changelog.outputs.version }}
 
-      # Publish to NPM first, before pushing to repository
-      # If this fails, no changes are pushed to the repository, ensuring consistency
+      # Publish to NPM first, before pushing to repository. If this fails, no changes are pushed to the repository, ensuring consistency
       - name: Publish to NPM public repository
         run: npm publish --provenance
 
@@ -60,14 +108,14 @@ jobs:
         run: git push origin main && git push --tags
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
         with:
           tag_name: v${{ steps.release-changelog.outputs.version }}
           body: ${{ steps.release-changelog.outputs.content }}
           token: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
 
       - name: Trigger documentation deploy
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
         with:
           token: ${{ secrets.TRIGGER_DOCS_DEPLOY_TOKEN }}
           event-type: engine-release
@@ -75,8 +123,8 @@ jobs:
           client-payload: '{"version": "v${{ steps.release-changelog.outputs.version }}"}'
 
   clean_changelog:
-    if: needs.changelog.outputs.release-type == 'no-release'
-    needs: [ changelog ]
+    needs: changelog
+    if: ${{ needs.changelog.outputs.release-type == 'no-release' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c723c2e98..24532e6a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All changes that impact users of this module are documented in this file, in the [Common Changelog](https://common-changelog.org) format with some additional specifications defined in the CONTRIBUTING file. This codebase adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased [no-release]
+
+_Modifications made in this changeset do not add, remove or alter any behavior, dependency, API or functionality of the software. They only change non-functional parts of the repository, such as the README file or CI workflows._
+
 ## 10.3.1 - 2026-01-13
 
 > Development of this release was supported by [Reset Tech](https://www.reset.tech).