diff --git a/.github/workflows/config/changelog-config.json b/.github/workflows/config/changelog-config.json
index e640b90a0f3..ea9d489e5e0 100644
--- a/.github/workflows/config/changelog-config.json
+++ b/.github/workflows/config/changelog-config.json
@@ -1,7 +1,7 @@
 {
     "categories": [],
     "ignore_labels": [
-      "ignore"
+        "ignore"
     ],
     "sort": "ASC",
     "template": "\n${{CHANGELOG}}\n\n<details><summary>Changelog Details</summary>\n\n${{UNCATEGORIZED}}\n</details>\n",
@@ -9,16 +9,21 @@
     "commit_template": "- ${{TITLE}} by @${{AUTHOR}}",
     "empty_template": "${{OWNER}}\n${{REPO}}\n${{FROM_TAG}}\n${{TO_TAG}}",
     "duplicate_filter": {
-      "pattern": ".+",
-      "on_property": "title",
-      "method": "match"
+        "pattern": ".+",
+        "on_property": "title",
+        "method": "match"
     },
-    "transformers": [],
+    "transformers": [
+        {
+            "pattern": "^cp:\\s*`(.+?)`\\s*into\\s*\\S+",
+            "target": "$1"
+        }
+    ],
     "max_tags_to_fetch": 100,
     "max_pull_requests": 500,
     "max_back_track_time_days": 365,
     "exclude_merge_branches": [],
     "tag_resolver": {
-      "method": "semver"
+        "method": "semver"
     }
 }
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 8a45d1f7755..87c48a70c63 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -77,15 +77,14 @@ jobs:
       default_test_data_path: ${{ vars.DEFAULT_TEST_DATA_PATH }}
       non_nvidia_test_data_path: ${{ vars.NON_NVIDIA_TEST_DATA_PATH }}
       sso_users_filename: ${{ vars.SSO_USERS_FILENAME }}
-    secrets:
-      NVIDIA_MANAGEMENT_ORG_PAT: ${{ secrets.NVIDIA_MANAGEMENT_ORG_PAT }}
+    secrets: inherit  # pragma: allowlist secret
 
   release:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@2f00056b5f23aa546dd2587652b63dc359e94317
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_release_library.yml@v1.0.0
     needs: [pre-flight]
     if: |
-      github.event_name == 'workflow_dispatch'
-      || !(needs.pre-flight.outputs.docs_only == 'true'
+      !cancelled() && !failure()
+      && !(needs.pre-flight.outputs.docs_only == 'true'
            || needs.pre-flight.outputs.is_deployment_workflow == 'true')
     with:
       release-ref: ${{ inputs.release-ref || github.sha }}
@@ -110,30 +109,11 @@ jobs:
       container-options: "--gpus all --runtime=nvidia"
       extra-no-build-isolation-packages: "grpcio-tools"
       restrict-to-admins: true
-    secrets:
-      TWINE_USERNAME: __token__
-      TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
-      SLACK_WEBHOOK_ADMIN: ${{ secrets.SLACK_TEAM_GROUP_ID }}
-      SLACK_WEBHOOK: ${{ secrets.SLACK_RELEASE_ENDPOINT }}
-      BOT_KEY: ${{ secrets.BOT_KEY }}
-      AWS_ASSUME_ROLE_ARN: ${{ secrets.AWS_ASSUME_ROLE_ARN }}
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      AKAMAI_HOST: ${{ secrets.AKAMAI_HOST }}
-      AKAMAI_CLIENT_TOKEN: ${{ secrets.AKAMAI_CLIENT_TOKEN }}
-      AKAMAI_CLIENT_SECRET: ${{ secrets.AKAMAI_CLIENT_SECRET }}
-      AKAMAI_ACCESS_TOKEN: ${{ secrets.AKAMAI_ACCESS_TOKEN }}
-      S3_BUCKET_NAME: ${{ secrets.S3_BUCKET_NAME }}
+    secrets: inherit  # pragma: allowlist secret
 
   release-summary:
     needs: [pre-flight, release]
-    if: |
-      (
-        needs.pre-flight.outputs.docs_only == 'true'
-        || needs.pre-flight.outputs.is_deployment_workflow == 'true'
-        || always()
-      )
-      && !cancelled()
+    if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
     steps:
       - name: Result