diff --git a/.gitea/workflows/build_release.yaml b/.gitea/workflows/build_release.yaml
index fc20416..8b377da 100644
--- a/.gitea/workflows/build_release.yaml
+++ b/.gitea/workflows/build_release.yaml
@@ -1,46 +1,78 @@
 on:
   push:
     tags:
-      - "*"
+      - "v*"
+
+concurrency:
+  group: release-${{ gitea.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     env:
       RUNNER_TOOL_CACHE: /toolcache
       PLATFORMIO_BUILD_CACHE_DIR: ~/.platformio/.build_cache
       PLATFORMIO_CACHE_DIR: ~/.platformio/.cachedir
-    name: Build
+    name: Build ${{ matrix.environment }}
+    strategy:
+      fail-fast: false
+      matrix:
+        environment:
+          - heltec_wifi_lora_32_V3_sailplane
+          - heltec_wifi_lora_32_V3_winde
     runs-on: ubuntu-latest
     container: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Cache
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: |
             ~/.cache/pip
             ~/.platformio/.cache
             ~/.platformio/.build_cache
             ~/.platformio/.cachedir
-          key: ${{ runner.os }}-pio
+          key: ${{ runner.os }}-pio-6.1.18-${{ hashFiles('platformio.ini', 'extra_script.py') }}
+          restore-keys: |
+            ${{ runner.os }}-pio-6.1.18-
+            ${{ runner.os }}-pio-
       - name: Set up python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.14.0"
           architecture: "x64"
       - name: Install PlatformIO
         run: python3 -m pip install platformio==6.1.18
-      - name: Build firmwares
-        run: FIRMWARE_VERSION=${{gitea.ref_name}} platformio run
-      - name: Archive
-        uses: christopherhx/gitea-upload-artifact@v4
+      - name: Validate version and required files
+        env:
+          TAG_NAME: ${{ gitea.ref_name }}
+        run: |
+          VERSION="${TAG_NAME#v}"
+          grep -qE "^## (v)?${VERSION} " CHANGELOG.md
+          test -s LICENSE
+          test -s THIRD_PARTY_NOTICES.md
+      - name: Static analysis
+        run: python3 -m platformio check --environment "${{ matrix.environment }}"
+      - name: Build firmware
+        env:
+          FIRMWARE_VERSION: ${{ gitea.ref_name }}
+        run: python3 -m platformio run --environment "${{ matrix.environment }}"
+      - name: Verify firmware and create checksum
+        run: |
+          test -n "$(find ".pio/build/${{ matrix.environment }}" -maxdepth 1 -type f -name 'firmware_*.bin' -print -quit)
+          sha256sum ".pio/build/${{ matrix.environment }}"/firmware_*.bin > "firmware-${{ matrix.environment }}.sha256"
+      - name: Archive firmware
+        uses: christopherhx/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2 # v4
         with:
-          name: firmware
-          path: .pio/build/*/firmware_*.bin
+          name: firmware-${{ matrix.environment }}
+          path: |
+            .pio/build/${{ matrix.environment }}/firmware_*.bin
+            firmware-${{ matrix.environment }}.sha256
           retention-days: 1
   release:
     name: Release
-    # if: startsWith(github.event.ref, 'refs/tags/v')
+    if: startsWith(gitea.ref, 'refs/tags/v')
     needs: build
     permissions:
       contents: write
@@ -48,17 +80,29 @@ jobs:
     container: catthehacker/ubuntu:act-latest
     steps:
       - name: Checkout repo for CHANGELOG
-        uses: actions/checkout@v4
-      - name: Download artifacts
-        uses: christopherhx/gitea-download-artifact@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Download Sailplane artifact
+        uses: christopherhx/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # v4
         with:
-          name: firmware
-          path: firmware
-      # - name: Display structure of downloaded files
-      #   run: ls -R
-      - name: release
-        uses: akkuman/gitea-release-action@v1
+          name: firmware-heltec_wifi_lora_32_V3_sailplane
+          path: firmware/sailplane
+      - name: Download Winde artifact
+        uses: christopherhx/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7 # v4
+        with:
+          name: firmware-heltec_wifi_lora_32_V3_winde
+          path: firmware/winde
+      - name: Verify release assets
+        run: |
+          test -n "$(find firmware -type f -name 'firmware_*.bin' -print -quit)"
+          test -n "$(find firmware -type f -name '*.sha256' -print -quit)"
+          test -s LICENSE
+          test -s THIRD_PARTY_NOTICES.md
+      - name: Create release
+        uses: akkuman/gitea-release-action@5a83c90484ef4355121df5eb60558c8ce66e81ac # v1
         with:
           files: |-
-                **/firmware_*.bin
-          body_path: "CHANGELOG.md"
\ No newline at end of file
+            firmware/**/*.bin
+            firmware/**/*.sha256
+            LICENSE
+            THIRD_PARTY_NOTICES.md
+          body_path: "CHANGELOG.md"