diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index be27bdc..1094dfd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,7 +13,8 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'monthly'
+      interval: 'weekly'
+    target-branch: 'development'
     groups:
       github-actions:
         patterns:
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index c969846..91799b7 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -1,16 +1,21 @@
+---
 name: Checks
 
 on:
   push:
     branches:
+      - development
       - main
+      - master
   pull_request:
     branches:
+      - development
       - main
+      - master
+
+permissions:
+  contents: read
 
 jobs:
   checks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: Screenly/edge-apps-actions/checks@v1
+    uses: Screenly/edge-apps-actions/.github/workflows/checks.yml@v26.10.2
diff --git a/.github/workflows/initialize-edge-app.yml b/.github/workflows/initialize-edge-app.yml
index 06319a7..391eb5d 100644
--- a/.github/workflows/initialize-edge-app.yml
+++ b/.github/workflows/initialize-edge-app.yml
@@ -21,21 +21,17 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 run-name: Initializing ${{ inputs.edge_app_name }} in ${{ inputs.environment }}
 
 jobs:
   initialize:
-    name: Initializing ${{ inputs.edge_app_name }} in ${{ inputs.environment }}
-    runs-on: ubuntu-latest
-    environment: ${{ inputs.environment }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          ref: main
-      - uses: Screenly/edge-apps-actions/initialize@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
-        with:
-          screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
-          edge_app_name: ${{ inputs.edge_app_name }}
-          edge_app_title: ${{ inputs.edge_app_title }}
-          environment: ${{ inputs.environment }}
-          edge_app_id: ${{ secrets.EDGE_APP_ID || (inputs.environment == 'production' && vars.PRODUCTION_EDGE_APP_ID || (inputs.environment == 'stage' && vars.STAGE_EDGE_APP_ID)) }}
+    uses: Screenly/edge-apps-actions/.github/workflows/initialize.yml@v26.10.2
+    with:
+      environment: ${{ inputs.environment }}
+      edge_app_name: ${{ inputs.edge_app_name }}
+      edge_app_title: ${{ inputs.edge_app_title }}
+    secrets:
+      SCREENLY_API_TOKEN: ${{ secrets.SCREENLY_API_TOKEN }}
diff --git a/.github/workflows/update-edge-app.yml b/.github/workflows/update-edge-app.yml
index 9181ede..4688ae8 100644
--- a/.github/workflows/update-edge-app.yml
+++ b/.github/workflows/update-edge-app.yml
@@ -2,39 +2,21 @@
 name: Update Edge App
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
+      - master
     tags:
-      - 'v*'
+      - 'v[0-9]*'
 
-run-name: Updating RSS Reader in ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'stage' }}
+permissions:
+  contents: read
 
-jobs:
-  deploy-stage:
-    name: Updating RSS Reader in stage
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
-    environment: stage
-    steps:
-      - uses: actions/checkout@v6
-      - uses: Screenly/edge-apps-actions/update@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
-        with:
-          screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
-          environment: stage
-          delete_missing_settings: 'true'
-          edge_app_id: ${{ secrets.EDGE_APP_ID || vars.STAGE_EDGE_APP_ID }}
+run-name: Updating RSS Reader in ${{ (github.event_name == 'push' && !github.event.deleted && startsWith(github.ref, 'refs/tags/v')) && 'production' || 'stage' }}
 
-  deploy-production:
-    name: Updating RSS Reader in production
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
-    environment: production
-    steps:
-      - uses: actions/checkout@v6
-      - uses: Screenly/edge-apps-actions/update@f4ccd2bd50db5fb0a5147d287ac03cafe552d29b
-        with:
-          screenly_api_token: ${{ secrets.SCREENLY_API_TOKEN }}
-          environment: production
-          delete_missing_settings: 'true'
-          edge_app_id: ${{ secrets.EDGE_APP_ID || vars.PRODUCTION_EDGE_APP_ID }}
+jobs:
+  update:
+    uses: Screenly/edge-apps-actions/.github/workflows/update.yml@v26.10.2
+    secrets:
+      SCREENLY_API_TOKEN: ${{ secrets.SCREENLY_API_TOKEN }}
diff --git a/README.md b/README.md
index fc80680..2a20f8f 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,5 @@
+[![Version](https://img.shields.io/github/v/release/Screenly/rss-reader-app)](https://github.com/Screenly/rss-reader-app/releases/latest)
+
 # RSS Reader
 
 Displays the latest entries from any RSS feed on your Screenly digital signage screens.
@@ -44,6 +46,22 @@ bun run deploy
 screenly edge-app instance create
 ```
 
+### Releasing
+
+Pushes to `main` start a stage deploy, which waits for approval. To release to production, tag a commit on `main` and push the tag (the workflow refuses tags not on `main`); the production deploy also waits for approval:
+
+```bash
+git checkout main && git pull
+git tag v26.10.0
+git push origin v26.10.0
+```
+
+Then publish a GitHub Release whose notes list the pull requests merged since the previous release. Add `--draft` to review the notes before publishing:
+
+```bash
+gh release create v26.10.0 --verify-tag --generate-notes --title v26.10.0
+```
+
 ## Configuration
 
 | Setting             | Description                                                          | Type     | Default                                |