diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 85e356a..821fb6f 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -2,6 +2,8 @@ name: Changelog
 
 on:
   pull_request:
+  push:
+    branches: [ 'push-action/**' ]  # enable testing required checks, see https://github.com/CasperWA/push-protected?tab=readme-ov-file#update-your-workflow
   workflow_call:
     outputs:
       release-type:
@@ -10,6 +12,7 @@ on:
 
 jobs:
   validate-changelog:
+    if: github.base_ref == 'main' || github.base_ref == 'test-main'  # check that changelog has valid unreleased changes only in PRs that could trigger a release
     runs-on: [ ubuntu-latest ]
     outputs:
       release-type: ${{ steps.validate-changelog.outputs.release-type }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 983423b..160b5b6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,8 +1,9 @@
 name: Release
 
 on:
-  push:
-    branches: [ main ]
+  pull_request_target:
+    branches: [ main, test-main ]
+    types: [ closed ]
 
 jobs:
   changelog:
@@ -12,6 +13,7 @@ jobs:
     uses: ./.github/workflows/test.yml
 
   release:
+    if: github.event.pull_request.merged == true
     needs: [ changelog, test ]
     runs-on: ubuntu-latest
     steps:
@@ -30,13 +32,18 @@ jobs:
           git config user.name "Open Terms Archive Release Bot"
           git config user.email "release-bot@opentermsarchive.org"
           git commit --message="Update changelog" CHANGELOG.md package.json package-lock.json
-          git push origin
+          [ ${{ needs.changelog.outputs.release-type }} != 'no-release' ] && git tag v${{ steps.update-changelog.outputs.version }}
 
-      - name: Tag commit
-        if: needs.changelog.outputs.release-type != 'no-release'
-        run: |
-          git tag v${{ steps.update-changelog.outputs.version }}
-          git push origin --tags
+      - name: Run status checks for release commit on temporary branch  # use temporary branch to enable pushing commits to this branch protected by required status checks
+        uses: CasperWA/push-protected@v2
+        with:
+          token: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          branch: main
+          acceptable_conclusions: 'success,skipped'  # changelog checks are skipped when not in a PR towards main branch
+          tags: true
+          interval: 10  # seconds between checks
+          pre_sleep: 15
+          fail_fast: true
 
       - name: Publish to NPM public repository
         if: needs.changelog.outputs.release-type != 'no-release'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9529d62..f409d9a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,11 +2,9 @@ name: Validate document types
 
 on:
   push:
-    branches-ignore: [ main ]  # will be called from workflow call
-  pull_request:
-    types: [ opened, reopened ]
+    branches-ignore: [ main, test-main ]  # will be called from workflow call
   workflow_call:
-  
+
 jobs:
   validate:
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d76a6e9..1793f0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,10 +11,6 @@ All changes that impact users of this module are documented in this file, in the
 - Use [@OpenTermsArchive/changelog-action](https://github.com/OpenTermsArchive/changelog-action/) in CI/CD
 - Decrease package size to half
 
-## Unreleased [no-release]
-
-_Modifications made in this changeset do not add, remove or alter any behavior, dependency, API or functionality of the software. They only change non-functional parts of the repository, such as the README file or CI workflows._
-
 ## 1.1.0 - 2023-10-25
 
 ### Added