diff --git a/.github/workflows/build-mobile.yml b/.github/workflows/build-mobile.yml
index 6a9a01d41..68744fada 100644
--- a/.github/workflows/build-mobile.yml
+++ b/.github/workflows/build-mobile.yml
@@ -38,7 +38,7 @@ on:
         required: true
   pull_request:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -46,6 +46,9 @@ concurrency:
 
 permissions: {}
 
+env:
+  DEPLOY: ${{ inputs.environment == 'production' || github.ref == 'refs/heads/main' }}
+
 jobs:
   pre-job:
     runs-on: ubuntu-latest
@@ -143,10 +146,9 @@ jobs:
           ALIAS: ${{ secrets.ALIAS }}
           ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
           ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_STORE_PASSWORD }}
-          IS_MAIN: ${{ github.ref == 'refs/heads/main' }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          if [[ $IS_MAIN == 'true' ]]; then
+          if [[ $DEPLOY == 'true' ]]; then
             flutter build apk --release
             flutter build apk --release --split-per-abi --target-platform android-arm,android-arm64,android-x64
           else
@@ -229,7 +231,7 @@ jobs:
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '3.3'
-          bundler-cache: true
+          bundler-cache: true # zizmor: ignore[cache-poisoning] release branches cannot read caches written by pull requests
           working-directory: ./mobile/ios
 
       - name: Install dependencies
@@ -288,21 +290,16 @@ jobs:
           APP_STORE_CONNECT_API_KEY_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ID }}
           APP_STORE_CONNECT_API_KEY_ISSUER_ID: ${{ secrets.APP_STORE_CONNECT_API_KEY_ISSUER_ID }}
           ENVIRONMENT: ${{ inputs.environment || 'development' }}
-          GITHUB_REF: ${{ github.ref }}
           FASTLANE_XCODEBUILD_SETTINGS_TIMEOUT: 120
           FASTLANE_XCODEBUILD_SETTINGS_RETRIES: 6
         working-directory: ./mobile/ios
         run: |
-          # Only upload to TestFlight on main branch
-          if [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
-            if [[ "$ENVIRONMENT" == "development" ]]; then
-              bundle exec fastlane gha_testflight_dev
-            else
-              bundle exec fastlane gha_release_prod
-            fi
-          else
-            # Build only, no TestFlight upload for non-main branches
+          if [[ "$DEPLOY" != 'true' ]]; then
             bundle exec fastlane gha_build_only
+          elif [[ "$ENVIRONMENT" == "development" ]]; then
+            bundle exec fastlane gha_testflight_dev
+          else
+            bundle exec fastlane gha_release_prod
           fi
 
       - name: Clean up keychain
diff --git a/.github/workflows/cli.yml b/.github/workflows/cli.yml
index cb20a017f..abc075259 100644
--- a/.github/workflows/cli.yml
+++ b/.github/workflows/cli.yml
@@ -1,7 +1,7 @@
 name: CLI Build
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
     paths:
       - 'packages/cli/**'
       - '.github/workflows/cli.yml'
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ed1246cee..18ffcb236 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -3,7 +3,7 @@ name: Docker
 on:
   workflow_dispatch:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
   pull_request:
   release:
     types: [published]
diff --git a/.github/workflows/docs-build.yml b/.github/workflows/docs-build.yml
index e0c5de3fa..e7911d97f 100644
--- a/.github/workflows/docs-build.yml
+++ b/.github/workflows/docs-build.yml
@@ -1,7 +1,7 @@
 name: Docs build
 on:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
   pull_request:
   release:
     types: [published]
diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index a8cebb7cd..78f7a57fe 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -18,6 +18,18 @@ jobs:
       sha: ${{ steps.version.outputs.sha }}
     permissions: {}
     steps:
+      - name: Check this is a release branch
+        env:
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          case "${BRANCH}" in
+            release/*) ;;
+            *)
+              echo "::error::releases are drafted from a release branch, not ${BRANCH}"
+              exit 1
+              ;;
+          esac
+
       - id: token
         uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
diff --git a/.github/workflows/migration-order.yml b/.github/workflows/migration-order.yml
index 94708b486..9975c87e2 100644
--- a/.github/workflows/migration-order.yml
+++ b/.github/workflows/migration-order.yml
@@ -3,7 +3,7 @@ name: Migration Order
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -14,6 +14,7 @@ permissions: {}
 jobs:
   migration-order:
     name: Verify migration ORDER
+    if: ${{ !github.event.created }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index aa26603f1..0fef2ac24 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -6,15 +6,12 @@ on:
       releaseType:
         description: 'Release type'
         required: true
-        default: 'false'
+        default: 'preminor'
         type: choice
         options:
-          - 'false'
-          - minor
-          - patch
           - premajor
           - preminor
-          - prepatch
+          - patch
           - prerelease
           - release
       skipTranslations:
@@ -32,7 +29,7 @@ jobs:
   merge_translations:
     uses: ./.github/workflows/merge-translations.yml
     with:
-      skip: ${{ inputs.skipTranslations }}
+      skip: ${{ inputs.skipTranslations || github.ref_name != 'main' }}
     permissions:
       pull-requests: write
     secrets:
@@ -47,6 +44,20 @@ jobs:
       version: ${{ steps.output.outputs.version }}
     permissions: {}
     steps:
+      - name: Check the release type suits this branch
+        env:
+          BRANCH: ${{ github.ref_name }}
+          RELEASE_TYPE: ${{ inputs.releaseType }}
+        run: |
+          case "${BRANCH}:${RELEASE_TYPE}" in
+            main:premajor | main:preminor) ;;
+            release/*:patch | release/*:prerelease | release/*:release) ;;
+            *)
+              echo "::error::${RELEASE_TYPE} cannot be released from ${BRANCH}"
+              exit 1
+              ;;
+          esac
+
       - id: token
         uses: immich-app/devtools/actions/create-workflow-token@1af396ae134e4bc3b63d947e672bc68bf4ff9dc5 # create-workflow-token-action-v3.0.0
         with:
@@ -59,7 +70,6 @@ jobs:
         with:
           token: ${{ steps.token.outputs.token }}
           persist-credentials: true
-          ref: main
 
       - name: Setup Mise
         uses: immich-app/devtools/actions/use-mise@06a9ef925332c91be647d6256642b86b398592c8 # use-mise-action-v3.2.1
@@ -87,3 +97,11 @@ jobs:
           git add -A
           git commit -m "chore: version ${VERSION}"
           git push
+
+      - name: Cut the release branch
+        if: ${{ github.ref_name == 'main' }}
+        env:
+          VERSION: ${{ steps.output.outputs.version }}
+        run: |
+          line=$(sed -E 's/^(v[0-9]+\.[0-9]+).*/\1/' <<< "${VERSION}")
+          git push origin "HEAD:refs/heads/release/${line}"
diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 0a3c61668..e53375f64 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8a4ecceb1..5da8fd000 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,7 +3,7 @@ on:
   workflow_dispatch:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, 'release/*']
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/packages/scripts/src/commands/release.spec.ts b/packages/scripts/src/commands/release.spec.ts
index dc3f82517..76931edcd 100644
--- a/packages/scripts/src/commands/release.spec.ts
+++ b/packages/scripts/src/commands/release.spec.ts
@@ -32,6 +32,13 @@ describe(getNewVersion.name, () => {
           ['release', '2.8.0-rc.1', '2.8.0'],
         ],
       },
+      {
+        name: 'cutting the next line while on a prerelease',
+        items: [
+          ['preminor', '3.3.0-rc.0', '3.4.0-rc.0'],
+          ['premajor', '3.3.0-rc.0', '4.0.0-rc.0'],
+        ],
+      },
       {
         name: 'premajor',
         items: [
@@ -58,8 +65,6 @@ describe(getNewVersion.name, () => {
         ['patch', 'v3.0.0-rc.0'],
         ['prepatch', 'v3.0.0-rc.0'],
         ['minor', 'v3.0.0-rc.0'],
-        ['preminor', 'v3.0.0-rc.0'],
-        ['premajor', 'v3.0.0-rc.0'],
         ['prerelease', 'v3.0.0'],
         ['release', 'v3.0.0'],
       ])('should not allow a $0 on $1', (type, version) => {
diff --git a/packages/scripts/src/commands/release.ts b/packages/scripts/src/commands/release.ts
index 2c0d82d5f..78e5027bd 100644
--- a/packages/scripts/src/commands/release.ts
+++ b/packages/scripts/src/commands/release.ts
@@ -123,15 +123,20 @@ export const getNewVersion = (versionRaw: string, type: string) => {
   switch (type) {
     case 'patch':
     case 'prepatch':
-    case 'minor':
-    case 'preminor':
-    case 'premajor': {
+    case 'minor': {
       newVersionRaw = inc(version, type);
       // can only use while not in a prerelease
       valid = !isPrerelease(version);
       break;
     }
 
+    case 'preminor':
+    case 'premajor': {
+      // cutting the next release line is allowed while main sits on a prerelease
+      newVersionRaw = inc(version, type);
+      break;
+    }
+
     case 'prerelease': {
       newVersionRaw = inc(version, type);
       // can only use while in a prerelease