diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a6948d6ed6..a537310923 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,4 +1,3 @@
-# GH_TOKEN
 # NEXUS_USER
 # NEXUS_PASS64 (base64 NOTE: `base64` and `openssl base64` failed, had to use Java
 #   byte[] data = "{{password}}".getBytes(StandardCharsets.UTF_8);
@@ -29,8 +28,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     name: deploy
+    permissions:
+      contents: write
     env:
-      gh_token: ${{ secrets.GH_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       ORG_GRADLE_PROJECT_nexus_user: ${{ secrets.NEXUS_USER }}
       ORG_GRADLE_PROJECT_nexus_pass64: ${{ secrets.NEXUS_PASS64 }}
       ORG_GRADLE_PROJECT_gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
@@ -64,3 +65,6 @@ jobs:
         if: "${{ github.event.inputs.to_publish == 'lib' }}"
         run: |
           ./gradlew :changelogPush -Prelease=true --stacktrace --warning-mode all --no-configuration-cache
+      - run: git checkout main
+      - run: git merge release --ff-only
+      - run: git push origin main
\ No newline at end of file
diff --git a/gradle/changelog.gradle b/gradle/changelog.gradle
index 2cad156a63..61813f9797 100644
--- a/gradle/changelog.gradle
+++ b/gradle/changelog.gradle
@@ -1,11 +1,15 @@
 String kind
+String releaseTitle
 if (project.name == 'plugin-gradle') {
 	kind = 'gradle'
+	releaseTitle = 'Gradle Plugin'
 } else if (project.name == 'plugin-maven') {
 	kind = 'maven'
+	releaseTitle = 'Maven Plugin'
 } else {
 	assert project == rootProject
 	kind = 'lib'
+	releaseTitle = 'Lib'
 }
 
 // the root project and plugins have their own changelogs
@@ -18,13 +22,15 @@ spotlessChangelog {
 	branch        'release'
 	tagPrefix     "${kind}/"
 	commitMessage "Published ${kind}/{{version}}" // {{version}} will be replaced
+	tagMessage "${kind} v{{version}}\n\n{{changes}}"
+	runAfterPush "gh release create ${kind}/{{version}} --title '${releaseTitle} v{{version}}' --notes-from-tag"
 
 	if (kind == 'gradle') {
-		forceNextVersion '7.0.0.BETA1'
+		forceNextVersion '7.0.0.BETA2'
 	} else if (kind == 'maven') {
-		forceNextVersion '2.44.0.BETA1'
+		forceNextVersion '2.44.0.BETA2'
 	} else {
-		forceNextVersion '3.0.0.BETA1'
+		forceNextVersion '3.0.0.BETA2'
 	}
 }
 
diff --git a/settings.gradle b/settings.gradle
index 4ca58af94a..024080384e 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -14,7 +14,7 @@ plugins {
 	// https://github.com/spotbugs/spotbugs-gradle-plugin/releases
 	id 'com.github.spotbugs' version '6.0.20' apply false
 	// https://github.com/diffplug/spotless-changelog/blob/main/CHANGELOG.md
-	id 'com.diffplug.spotless-changelog' version '3.0.2' apply false
+	id 'com.diffplug.spotless-changelog' version '3.1.2' apply false
 	// https://github.com/radarsh/gradle-test-logger-plugin/blob/develop/CHANGELOG.md
 	id 'com.adarshr.test-logger' version '4.0.0' apply false
 	// https://github.com/davidburstrom/version-compatibility-gradle-plugin/tags