diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..9255d721
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "main"
+    commit-message:
+      prefix: "ci:"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 69c00a49..fe663418 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,9 +4,15 @@ on:
   push:
     tags:
       - 'v[0-9]+.[0-9]+.[0-9]*'
+  workflow_dispatch:
+    inputs:
+      tag_ref:
+        description: 'Tag reference (e.g., v1.2.3)'
+        required: true
+        type: string
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.after }}
+  group: ${{ github.workflow }}-${{ github.event.after || github.run_id }}
   cancel-in-progress: true
 
 env:
@@ -14,11 +20,35 @@ env:
   LLVM_URL_PREFIX: https://github.com/llvm/llvm-project/releases/download/llvmorg-15.0.0
   LLVM_arm64: clang+llvm-15.0.0-aarch64-linux-gnu
   LLVM_amd64: clang+llvm-15.0.0-x86_64-linux-gnu-rhel-8.4
+  # Set the tag reference based on trigger type
+  TAG_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_ref || github.ref_name }}
 
 jobs:
+  validate-tag:
+    name: Validate tag exists (manual dispatch only)
+    runs-on: ubuntu-22.04
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+        with:
+          fetch-depth: 0  # Fetch all tags
+
+      - name: Check if tag exists
+        run: |
+          if ! git tag -l | grep -q "^${{ inputs.tag_ref }}$"; then
+            echo "Error: Tag '${{ inputs.tag_ref }}' does not exist in the repository"
+            echo "Available tags:"
+            git tag -l
+            exit 1
+          fi
+          echo "Tag '${{ inputs.tag_ref }}' found"
+
   build:
     name: Build static bpftool binary
     runs-on: ubuntu-22.04
+    needs: [validate-tag]
+    if: always() && (needs.validate-tag.result == 'success' || needs.validate-tag.result == 'skipped')
     env:
       TARGETARCH: ${{ matrix.arch }}
       FILE_STRING_ARCH_amd64: x86-64
@@ -48,6 +78,8 @@ jobs:
           submodules: recursive
           # Create a new directory to avoid wiping out LLVM on bpftool checkout
           path: 'bpftool'
+          # For manual dispatch, checkout the specific tag
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_ref || github.ref }}
 
       - name: Build static bpftool natively for amd64
         if: matrix.arch == 'amd64'
@@ -104,7 +136,7 @@ jobs:
               grep -q 'not a dynamic executable'
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ format('bpftool_{0}', matrix.arch) }}
           path: bpftool/src/bpftool
@@ -112,17 +144,17 @@ jobs:
   draft-release:
     name: Create a draft release
     runs-on: ubuntu-22.04
-    needs: build
+    needs: [build]
     permissions:
       contents: write
     steps:
       - name: Download artifacts from build
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
 
       - name: Rename binaries and compress
         run: |
-          archive_amd64="bpftool-${{ github.ref_name }}-amd64.tar.gz"
-          archive_arm64="bpftool-${{ github.ref_name }}-arm64.tar.gz"
+          archive_amd64="bpftool-${{ env.TAG_REF }}-amd64.tar.gz"
+          archive_arm64="bpftool-${{ env.TAG_REF }}-arm64.tar.gz"
           tar -C bpftool_amd64 -I 'gzip -9' -cvf "${archive_amd64}" bpftool
           tar -C bpftool_arm64 -I 'gzip -9' -cvf "${archive_arm64}" bpftool
           sha256sum "${archive_amd64}" > "${archive_amd64}.sha256sum"
@@ -133,11 +165,13 @@ jobs:
         with:
           submodules: recursive
           path: 'bpftool'
+          # For manual dispatch, checkout the specific tag
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_ref || github.ref }}
 
       - name: Package source code including submodules
         uses: qmonnet/git-archive-all-action@791fb850881cf58b1d1fcc9b06c01940080bba0a # v1.0.1
         with:
-          output-files: bpftool-libbpf-${{ github.ref_name }}-sources.tar.gz
+          output-files: bpftool-libbpf-${{ env.TAG_REF }}-sources.tar.gz
           base-repo: bpftool
 
       - name: Create draft release and add artifacts
@@ -145,3 +179,5 @@ jobs:
         with:
           draft: true
           files: bpftool*
+          tag_name: ${{ env.TAG_REF }}
+          generate_release_notes: true