diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68d8920..68b95a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,13 +37,13 @@ jobs:
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Check, package, and verify plugin
         run: ./gradlew check koverXmlReport buildPlugin verifyPlugin
 
       - name: Upload plugin artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: intellij-codexp-plugin
           path: build/distributions/*.zip
@@ -51,7 +51,7 @@ jobs:
 
       - name: Upload test report
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-report
           path: build/reports/tests
@@ -59,7 +59,7 @@ jobs:
 
       - name: Upload plugin verifier report
         if: ${{ always() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: plugin-verifier-report
           path: build/reports/pluginVerifier
@@ -67,51 +67,7 @@ jobs:
 
       - name: Upload coverage
         if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           files: build/reports/kover/report.xml
           token: ${{ env.CODECOV_TOKEN }}
-
-  release-draft:
-    name: Release draft
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-    needs: [build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Fetch sources
-        uses: actions/checkout@v6
-
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: zulu
-          java-version: 21
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
-        with:
-          cache-read-only: true
-
-      - name: Create release draft
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION="$(./gradlew properties --property version --quiet --console=plain | tail -n 1 | cut -f2- -d ' ')"
-          RELEASE_NOTE="./build/tmp/release_note.txt"
-          ./gradlew getChangelog --unreleased --no-header --quiet --console=plain --output-file="$RELEASE_NOTE"
-
-          if gh release view "v${VERSION}" >/dev/null 2>&1; then
-            IS_DRAFT="$(gh release view "v${VERSION}" --json isDraft --jq '.isDraft')"
-            if [ "$IS_DRAFT" != "true" ]; then
-              echo "Release v${VERSION} already exists and is not a draft."
-              exit 1
-            fi
-            gh release delete "v${VERSION}" --cleanup-tag --yes
-          fi
-
-          gh release create "v${VERSION}" \
-            --draft \
-            --title "v${VERSION}" \
-            --notes-file "$RELEASE_NOTE"
diff --git a/.github/workflows/release-draft.yml b/.github/workflows/release-draft.yml
new file mode 100644
index 0000000..e2e00ef
--- /dev/null
+++ b/.github/workflows/release-draft.yml
@@ -0,0 +1,61 @@
+name: Release Draft
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to create the release draft from
+        required: true
+        default: main
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-draft-${{ inputs.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-draft:
+    name: Create release draft
+    if: ${{ github.repository == 'ByteAurora/intellij-codexp' && github.actor == 'ByteAurora' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch sources
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: zulu
+          java-version: 21
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: true
+
+      - name: Create release draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="$(./gradlew properties --property version --quiet --console=plain | tail -n 1 | cut -f2- -d ' ')"
+          RELEASE_NOTE="./build/tmp/release_note.txt"
+          ./gradlew getChangelog --unreleased --no-header --quiet --console=plain --output-file="$RELEASE_NOTE"
+
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
+            IS_DRAFT="$(gh release view "v${VERSION}" --json isDraft --jq '.isDraft')"
+            if [ "$IS_DRAFT" != "true" ]; then
+              echo "Release v${VERSION} already exists and is not a draft."
+              exit 1
+            fi
+            gh release delete "v${VERSION}" --cleanup-tag --yes
+          fi
+
+          gh release create "v${VERSION}" \
+            --draft \
+            --target "${{ inputs.ref }}" \
+            --title "v${VERSION}" \
+            --notes-file "$RELEASE_NOTE"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b6eacad..b487fa6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Export release notes
         id: release-notes
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d09c23b..5b9fdec 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -29,9 +29,18 @@ Before opening a pull request:
 - Update `CHANGELOG.md` when the change affects users, compatibility, build, or release behavior.
 - Do not include private certificates, Marketplace tokens, or local signing files.
 
+## Branch Workflow
+
+- Use `develop` as the integration branch for normal work.
+- Open feature, fix, documentation, and maintenance pull requests against `develop`.
+- Use `main` as the stable release branch.
+- Merge `develop` into `main` only when preparing a release.
+- For urgent production fixes, branch from `main`, merge back into `main`, then merge the fix back into `develop`.
+
 ## Release Policy
 
 CodeXP is open source, but publishing to JetBrains Marketplace is restricted to the maintainer.
 
 Contributors should not run or request release publishing. Marketplace credentials are stored only in GitHub Secrets or protected GitHub Environments.
 
+Release drafts are created manually from the `Release Draft` workflow after the release changes have been merged into `main`. Publishing the GitHub Release triggers the protected Marketplace deployment workflow.