diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 1cf130d8c4..65809f15f0 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -84,6 +84,8 @@ jobs:
         fi
 
     - name: Checkout release branch
+      env:
+        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
       run: |
         echo "Checking out branch $BRANCH_NAME for release $PROWLER_VERSION..."
         if git show-ref --verify --quiet "refs/heads/$BRANCH_NAME"; then
@@ -92,8 +94,32 @@ jobs:
         elif git show-ref --verify --quiet "refs/remotes/origin/$BRANCH_NAME"; then
           echo "Branch $BRANCH_NAME exists remotely, checking out..."
           git checkout -b "$BRANCH_NAME" "origin/$BRANCH_NAME"
+        elif [ "$PATCH_VERSION" -eq 0 ]; then
+          # Only cut the branch once the compiled changelogs are on master
+          MASTER_SHA=$(git rev-parse origin/master)
+          VERSION_REGEX="${PROWLER_VERSION//./\\.}"
+          FOUND_CHANGELOG=false
+          for changelog in prowler/CHANGELOG.md api/CHANGELOG.md ui/CHANGELOG.md mcp_server/CHANGELOG.md; do
+            if git show "origin/master:$changelog" 2>/dev/null | grep -qE "^## \[.*\(Prowler v?${VERSION_REGEX}\)"; then
+              FOUND_CHANGELOG=true
+              break
+            fi
+          done
+          if [ "$FOUND_CHANGELOG" != "true" ]; then
+            echo "ERROR: No changelog entry for Prowler $PROWLER_VERSION on master. Merge the compiled changelogs PR first."
+            exit 1
+          fi
+          # Check the SDK version on master before creating the remote branch
+          if ! git show "origin/master:pyproject.toml" | grep -qE "^version = \"${VERSION_REGEX}\"$" \
+            || ! git show "origin/master:prowler/config/config.py" | grep -qE "^prowler_version = \"${VERSION_REGEX}\"$"; then
+            echo "ERROR: pyproject.toml or prowler/config/config.py on master is not at version $PROWLER_VERSION. Fix master before creating $BRANCH_NAME."
+            exit 1
+          fi
+          echo "Branch $BRANCH_NAME does not exist, creating it from master ($MASTER_SHA)..."
+          gh api --method POST "repos/${GITHUB_REPOSITORY}/git/refs" -f ref="refs/heads/${BRANCH_NAME}" -f sha="${MASTER_SHA}"
+          git checkout -b "$BRANCH_NAME" "$MASTER_SHA"
         else
-          echo "ERROR: Branch $BRANCH_NAME does not exist. For minor releases (X.Y.0), create it manually first. For patch releases (X.Y.Z), the branch should already exist."
+          echo "ERROR: Branch $BRANCH_NAME does not exist. For patch releases (X.Y.Z), the branch should already exist."
           exit 1
         fi
 
@@ -390,4 +416,3 @@ jobs:
       if: always()
       run: |
         rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
-
diff --git a/.github/workflows/release-freeze-lift.yml b/.github/workflows/release-freeze-lift.yml
new file mode 100644
index 0000000000..815d9bb268
--- /dev/null
+++ b/.github/workflows/release-freeze-lift.yml
@@ -0,0 +1,27 @@
+name: 'Tools: Release Freeze Lift'
+
+run-name: 'Lift release freeze after Prowler ${{ github.event.release.tag_name }}'
+
+on:
+  release:
+    types:
+      - 'published'
+
+permissions: {}
+
+jobs:
+  release-freeze-lift:
+    if: github.repository == 'prowler-cloud/prowler' && !github.event.release.prerelease
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Disable release freeze
+        env:
+          GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+        run: |
+          gh variable set RELEASE_FREEZE --body false --repo "${GITHUB_REPOSITORY}"