diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ecd517f..7e26950 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,13 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
-    branches: [ "main", "master" ]
+    branches: [ "main" ]
   pull_request:
-    branches: [ "main", "master" ]
+    branches: [ "main" ]
 
 jobs:
   check:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index de687d0..41bd16b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,10 +1,12 @@
 name: Release
 
+permissions:
+  contents: read
+
 on:
   push:
-    # Trigger on tag pushes. Adjust pattern as needed (e.g. 'v*.*.*')
-    tags:
-      - '**'
+    branches:
+      - main
   workflow_dispatch:
 
 jobs:
@@ -25,7 +27,7 @@ jobs:
             cgo: 0
           - goos: linux
             goarch: arm
-            goarm: '7'
+            goarm: "7"
             cgo: 0
           - goos: darwin
             goarch: amd64
@@ -58,7 +60,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25.5'
+          go-version: "1.25.5"
 
       # Install Android NDK only for android rows
       - name: Setup Android NDK
@@ -114,7 +116,7 @@ jobs:
           go build -ldflags "-s -w -checklinkname=0" -trimpath \
             -o "dist/client-${GOOS}-${GOARCH}${EXT}" \
             ./client
-          
+
           GOOS=$GOOS GOARCH=$GOARCH GOARM=$GOARM \
           go build -ldflags "-s -w -checklinkname=0" -trimpath \
             -o "dist/server-${GOOS}-${GOARCH}${EXT}" \
@@ -133,20 +135,130 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
       - name: Download build artifacts
         uses: actions/download-artifact@v7
         with:
           path: dist
 
+      - name: Prepare release metadata
+        id: meta
+        run: |
+          LATEST_TAG="$(git tag -l | grep -E '^(v)?[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1 || true)"
+          PREFIX=""
+          BASE_VERSION="$LATEST_TAG"
+
+          if [ -z "$LATEST_TAG" ]; then
+            BASE_VERSION="0.0.0"
+          elif [ "${LATEST_TAG#v}" != "$LATEST_TAG" ]; then
+            PREFIX="v"
+            BASE_VERSION="${LATEST_TAG#v}"
+          fi
+
+          IFS=. read -r MAJOR MINOR PATCH <<< "$BASE_VERSION"
+
+          if [ -n "$LATEST_TAG" ]; then
+            RANGE="$LATEST_TAG..HEAD"
+          else
+            RANGE="HEAD"
+          fi
+
+          COMMITS="$(git log --no-merges --format='%s' "$RANGE")"
+          BUMP=""
+
+          if printf '%s\n' "$COMMITS" | grep -Eiq '^break([(:! ]|$)'; then
+            BUMP="major"
+            MAJOR=$((MAJOR + 1))
+            MINOR=0
+            PATCH=0
+          elif printf '%s\n' "$COMMITS" | grep -Eiq '^feat([(:! ]|$)'; then
+            BUMP="minor"
+            MINOR=$((MINOR + 1))
+            PATCH=0
+          elif printf '%s\n' "$COMMITS" | grep -Eiq '^fix([(:! ]|$)'; then
+            BUMP="patch"
+            PATCH=$((PATCH + 1))
+          fi
+
+          NEXT_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+          NEXT_TAG="${PREFIX}${NEXT_VERSION}"
+
+          {
+            echo "previous_tag=$LATEST_TAG"
+            echo "range=$RANGE"
+            echo "bump=$BUMP"
+            echo "should_release=$([ -n "$BUMP" ] && echo true || echo false)"
+            echo "tag_name=$NEXT_TAG"
+            echo "release_name=$NEXT_TAG"
+            echo "body_path=release-notes.md"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Generate release notes from commit messages
+        id: notes
+        if: steps.meta.outputs.should_release == 'true'
+        env:
+          PREVIOUS_TAG: ${{ steps.meta.outputs.previous_tag }}
+          NEXT_TAG: ${{ steps.meta.outputs.tag_name }}
+          BUMP: ${{ steps.meta.outputs.bump }}
+          RANGE: ${{ steps.meta.outputs.range }}
+        run: |
+          strip_prefix() {
+            sed -E 's/^(feat|fix|break)([(!:]|[[:space:]])+[[:space:]]*//I'
+          }
+
+          FEATURES="$(git log --no-merges --format='%s (%h)' "$RANGE" | grep -Ei '^feat([(:! ]|$)' | strip_prefix | LC_ALL=C sort -f || true)"
+          FIXES="$(git log --no-merges --format='%s (%h)' "$RANGE" | grep -Ei '^fix([(:! ]|$)' | strip_prefix | LC_ALL=C sort -f || true)"
+          BREAKING="$(git log --no-merges --format='%s (%h)' "$RANGE" | grep -Ei '^break([(:! ]|$)' | strip_prefix | LC_ALL=C sort -f || true)"
+
+          {
+            echo "body_path=release-notes.md"
+          } >> "$GITHUB_OUTPUT"
+
+          {
+            if [ -n "$BREAKING" ]; then
+              echo "### Несовместимые изменения"
+              echo
+              printf '%s\n' "$BREAKING" | sed 's/^/- /'
+              echo
+            fi
+
+            if [ -n "$FEATURES" ]; then
+              echo "### Новые функции"
+              echo
+              printf '%s\n' "$FEATURES" | sed 's/^/- /'
+              echo
+            fi
+
+            if [ -n "$FIXES" ]; then
+              echo "### Исправление багов"
+              echo
+              printf '%s\n' "$FIXES" | sed 's/^/- /'
+              echo
+            fi
+          } > release-notes.md
+
       - name: Create Release
+        if: steps.meta.outputs.should_release == 'true'
         uses: softprops/action-gh-release@v2
         with:
           # upload every file in dist/ including nested files
           files: |
             dist/**
-          # make the release name/tag the pushed tag
-          tag_name: ${{ github.ref_name }}
-          name: ${{ github.ref_name }}
+          tag_name: ${{ steps.meta.outputs.tag_name }}
+          target_commitish: ${{ github.sha }}
+          name: ${{ steps.meta.outputs.release_name }}
+          body_path: ${{ steps.meta.outputs.body_path }}
           overwrite_files: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Skip release when no semantic commit is found
+        if: steps.meta.outputs.should_release != 'true'
+        run: |
+          echo "No new semantic release created."
+          echo "Add a commit starting with break, feat, or fix after the latest tag."
diff --git a/go.mod b/go.mod
index db0b818..63d5b25 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/cbeuw/connutil v1.0.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
-	github.com/pion/dtls/v3 v3.0.10
+	github.com/pion/dtls/v3 v3.0.11
 	github.com/pion/logging v0.2.4
 	github.com/pion/turn/v5 v5.0.2
 )
diff --git a/go.sum b/go.sum
index 71673ee..bbaf68e 100644
--- a/go.sum
+++ b/go.sum
@@ -14,8 +14,8 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/miekg/dns v1.1.69 h1:Kb7Y/1Jo+SG+a2GtfoFUfDkG//csdRPwRLkCsxDG9Sc=
 github.com/miekg/dns v1.1.69/go.mod h1:7OyjD9nEba5OkqQ/hB4fy3PIoxafSZJtducccIelz3g=
-github.com/pion/dtls/v3 v3.0.10 h1:k9ekkq1kaZoxnNEbyLKI8DI37j/Nbk1HWmMuywpQJgg=
-github.com/pion/dtls/v3 v3.0.10/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
+github.com/pion/dtls/v3 v3.0.11 h1:zqn8YhoAU7d9whsWLhNiQlbB8QdpJj8XQVSc5ImUons=
+github.com/pion/dtls/v3 v3.0.11/go.mod h1:YEmmBYIoBsY3jmG56dsziTv/Lca9y4Om83370CXfqJ8=
 github.com/pion/logging v0.2.4 h1:tTew+7cmQ+Mc1pTBLKH2puKsOvhm32dROumOZ655zB8=
 github.com/pion/logging v0.2.4/go.mod h1:DffhXTKYdNZU+KtJ5pyQDjvOAh/GsNSyv1lbkFbe3so=
 github.com/pion/randutil v0.1.0 h1:CFG1UdESneORglEsnimhUjf33Rwjubwj6xfiOXBa3mA=