diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4ea1ee6..ece7eb1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -13,15 +13,30 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
-    name: Build & Test
-    uses: ./.github/workflows/build.yaml
+  trufflehog:
+    name: TruffleHog Secret Scan
+    runs-on: ubuntu-latest
     permissions:
       contents: read
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Run TruffleHog
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --results=verified,unknown
+
+  build:
+    name: Build & Test
+    needs: [trufflehog]
+    uses: ./.github/workflows/build.yaml
 
   docker:
     name: Docker
     needs: build
+    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
     uses: ./.github/workflows/docker.yaml
     permissions:
       contents: read
@@ -30,10 +45,10 @@ jobs:
       push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
     secrets: inherit
 
-  telegram-notify:
-    name: Send Telegram Notification
+  notify-main:
+    name: Notify Main Build
     needs: docker
-    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -42,13 +57,13 @@ jobs:
         env:
           TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
-          VERSION: ${{ github.ref_name }}
           REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
           DIGEST: ${{ needs.docker.outputs.image-digest }}
         run: |
-          RELEASE_URL="https://github.com/${REPO}/releases/tag/${VERSION}"
-          MSG="*${REPO}* - released *${VERSION}*"
-          MSG="${MSG}%0A🔗 [Release notes](${RELEASE_URL})"
+          COMMIT_URL="https://github.com/${REPO}/commit/${SHA}"
+          MSG="*${REPO}* - main branch CI succeeded"
+          MSG="${MSG}%0A🔗 [Commit](${COMMIT_URL})"
           if [ -n "${DIGEST}" ]; then
             MSG="${MSG}%0AImage: \`ghcr.io/${REPO}@${DIGEST}\`"
           fi
@@ -57,3 +72,15 @@ jobs:
             -d "chat_id=${CHAT_ID}" \
             -d "parse_mode=Markdown" \
             -d "text=${MSG}"
+
+  release:
+    name: Release
+    needs: docker
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    uses: ./.github/workflows/release.yaml
+    with:
+      version: ${{ github.ref_name }}
+      image-digest: ${{ needs.docker.outputs.image-digest }}
+    secrets: inherit