diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
new file mode 100644
index 0000000..a0a0ddf
--- /dev/null
+++ b/.github/dependabot.yaml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 15
+    labels:
+      - "changelog/ignore"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: "gomod"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 15
+    labels:
+      - "changelog/dependencies"
diff --git a/.github/release.yaml b/.github/release.yaml
new file mode 100644
index 0000000..10de894
--- /dev/null
+++ b/.github/release.yaml
@@ -0,0 +1,25 @@
+changelog:
+  exclude-labels:
+    - changelog/ignore
+  categories:
+    - title: Added
+      labels:
+        - changelog/added
+    - title: Changed
+      labels:
+        - changelog/changed
+    - title: Fixed
+      labels:
+        - changelog/fixed
+    - title: Deprecated
+      labels:
+        - changelog/deprecated
+    - title: Removed
+      labels:
+        - changelog/removed
+    - title: Security
+      labels:
+        - changelog/security
+    - title: Dependencies
+      labels:
+        - changelog/dependencies
diff --git a/.github/workflows/changelog-labels.yaml b/.github/workflows/changelog-labels.yaml
new file mode 100644
index 0000000..fe88fe6
--- /dev/null
+++ b/.github/workflows/changelog-labels.yaml
@@ -0,0 +1,20 @@
+name: changelog
+on:
+  pull_request:
+    types: [opened, labeled, unlabeled, synchronize]
+permissions:
+  pull-requests: read
+defaults:
+  run:
+    shell: bash
+jobs:
+  labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check changelog label
+        uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe #v5.5.2
+        with:
+          mode: exactly
+          count: 1
+          use_regex: true
+          labels: "changelog/.*"
diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
new file mode 100644
index 0000000..cc857e2
--- /dev/null
+++ b/.github/workflows/go.yaml
@@ -0,0 +1,33 @@
+name: go
+on:
+  pull_request:
+  push:
+    branches:
+      - 'main'
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6.4.0
+        with:
+          go-version-file: go.mod
+      - name: Run linter
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 #v9.2.0
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6.4.0
+        with:
+          go-version-file: go.mod
+      - name: Verify go mod is not dirty
+        run: |
+          go mod tidy
+          git diff --exit-code
+      - name: Run unit tests
+        run: make -B test-unit
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..586bedc
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,44 @@
+name: release
+on:
+  release:
+    types: [published]
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+defaults:
+  run:
+    shell: bash
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6.4.0
+        with:
+          go-version-file: go.mod
+      - name: Set up Docker
+        uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db #v5.1.0
+        with:
+          daemon-config: |
+            {
+              "features": {
+                "containerd-snapshotter": true
+              }
+            }
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
+        with:
+          driver: docker
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push image
+        run: |
+          IMG_REF=$(make build-image-multiarch IMG_REPOSITORY=${{ github.repository_owner }}/netbird-kubeapi-proxy IMG_TAG=${{ github.event.release.tag_name }}) || exit 1
+          docker push ${IMG_REF}
diff --git a/Makefile b/Makefile
index f8cec7b..46c3b1e 100644
--- a/Makefile
+++ b/Makefile
@@ -7,6 +7,10 @@ IMG_REF := $(IMG_REGISTRY)/$(IMG_REPOSITORY):$(IMG_TAG)
 lint:
 	@golangci-lint run ./...
 
+.PHONY: test
+test-unit:
+	@go test ./... -race
+
 .PHONY: build
 build: bin/linux-$(shell go env GOARCH)/netbird-kubeapi-proxy