diff --git a/.craft.yml b/.craft.yml
index aa9119014db4..67029c5f4c1e 100644
--- a/.craft.yml
+++ b/.craft.yml
@@ -1,5 +1,6 @@
 minVersion: '0.23.1'
-changelogPolicy: simple
+changelog:
+  policy: simple
 preReleaseCommand: bash scripts/craft-pre-release.sh
 targets:
   # NPM Targets
diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 02a1f47b611a..241900f4b6ff 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -6,7 +6,11 @@ on:
     branches:
       - master
 
-# This workflow tirggers a release when merging a branch with the pattern `prepare-release/VERSION` into master.
+# This workflow triggers a release when merging a branch with the pattern `prepare-release/VERSION` into master.
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     runs-on: ubuntu-24.04
@@ -47,7 +51,7 @@ jobs:
           node-version-file: 'package.json'
 
       - name: Prepare release
-        uses: getsentry/action-prepare-release@v1
+        uses: getsentry/craft@013a7b2113c2cac0ff32d5180cfeaefc7c9ce5b6 # v2.24.1
         if:
           github.event.pull_request.merged == true && steps.version-regex.outputs.match != '' &&
           steps.get_version.outputs.version != ''
diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
new file mode 100644
index 000000000000..b1a0e4f25b05
--- /dev/null
+++ b/.github/workflows/changelog-preview.yml
@@ -0,0 +1,19 @@
+name: Changelog Preview
+on:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+      - labeled
+      - unlabeled
+permissions:
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  changelog-preview:
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@2.24.1
+    secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fcb44598c722..d966e35e9671 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,8 +3,8 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Version to release
-        required: true
+        description: Version to release (or "auto")
+        required: false
       force:
         description: Force a release even when there are release-blockers (optional)
         required: false
@@ -12,6 +12,10 @@ on:
         description: Target branch to merge into. Uses the default branch as a fallback (optional)
         required: false
         default: master
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   release:
     runs-on: ubuntu-24.04
@@ -32,7 +36,7 @@ jobs:
         with:
           node-version-file: 'package.json'
       - name: Prepare release
-        uses: getsentry/action-prepare-release@v1
+        uses: getsentry/craft@013a7b2113c2cac0ff32d5180cfeaefc7c9ce5b6 # v2.24.1
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with: