diff --git a/.github/workflows/ci_release.yaml b/.github/workflows/ci_release.yaml
new file mode 100644
index 00000000..250c038f
--- /dev/null
+++ b/.github/workflows/ci_release.yaml
@@ -0,0 +1,26 @@
+---
+name: CI Release Tag
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  tag:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          persist-credentials: false
+
+      - name: Fetch major version tag and update it
+        shell: bash
+        run: |
+          VERSION=${GITHUB_REF#refs/tags/}
+          MAJOR=${VERSION%%.*}
+          git config --global user.name 'Rishav Dhar'
+          git config --global user.email '19497993+rdhar@users.noreply.github.com'
+          git tag -fa "${MAJOR}" -m 'Update major version tag'
+          git push origin "${MAJOR}" --force
diff --git a/.github/workflows/tf_sample.yaml b/.github/workflows/tf_sample.yaml
index 2196b432..ef0a82df 100644
--- a/.github/workflows/tf_sample.yaml
+++ b/.github/workflows/tf_sample.yaml
@@ -14,8 +14,8 @@ env:
   TF_VAR_PREFIX: sample
 
 jobs:
-  TF:
-    runs-on: ubuntu-latest
+  iac:
+    runs-on: ubuntu-24.04
 
     permissions:
       actions: read # Required to download repository artifact.
@@ -35,6 +35,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          persist-credentials: false
 
       - name: Authenticate AWS
         uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
diff --git a/.github/workflows/tf_tests.yaml b/.github/workflows/tf_tests.yaml
index 0dd23b42..71814e9f 100644
--- a/.github/workflows/tf_tests.yaml
+++ b/.github/workflows/tf_tests.yaml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     permissions:
       actions: read # Required to download repository artifact.
@@ -40,6 +40,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          persist-credentials: false
 
       - name: Provision TF
         id: tf