diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..cca6811
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Keep the actions used in .github/workflows up to date.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index eb98b20..cdcee69 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -29,7 +29,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 1
 
diff --git a/.github/workflows/hassfest.yaml b/.github/workflows/hassfest.yaml
index 8fe5df7..513b826 100644
--- a/.github/workflows/hassfest.yaml
+++ b/.github/workflows/hassfest.yaml
@@ -5,10 +5,14 @@ on:
   pull_request:
   schedule:
     - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   validate:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@v7"
       - uses: home-assistant/actions/hassfest@master
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..2757846
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,61 @@
+name: Release
+
+# Builds rohlikcz.zip (the file HACS downloads, see hacs.json) and attaches it
+# to the GitHub release. Runs when a release is published; it can also be run
+# by hand for an existing tag, for example to rebuild a missing ZIP.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to build and attach the ZIP to (e.g. v1.0.0)"
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  release-zip:
+    runs-on: ubuntu-latest
+    env:
+      TAG: ${{ github.event.release.tag_name || inputs.tag }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ env.TAG }}
+
+      - name: Check manifest version matches tag
+        run: |
+          manifest_version=$(jq -r .version custom_components/rohlikcz/manifest.json)
+          if [ "${TAG#v}" != "$manifest_version" ]; then
+            echo "::error::Tag $TAG does not match manifest version $manifest_version"
+            exit 1
+          fi
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: requirements_test.txt
+
+      - name: Run tests
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements_test.txt
+          python -m pytest tests/ -q
+
+      - name: Build ZIP
+        # HACS extracts the ZIP straight into custom_components/rohlikcz, so the
+        # integration's files must sit at the root of the archive.
+        working-directory: custom_components/rohlikcz
+        run: |
+          find . -name __pycache__ -type d -prune -exec rm -rf {} +
+          zip -r "$GITHUB_WORKSPACE/rohlikcz.zip" .
+          unzip -l "$GITHUB_WORKSPACE/rohlikcz.zip"
+
+      - name: Attach ZIP to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "$TAG" rohlikcz.zip --clobber --repo "$GITHUB_REPOSITORY"
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 57760c0..1c75031 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,13 +5,16 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pytest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.13"
           cache: pip
diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml
index 290f9af..785a1b6 100644
--- a/.github/workflows/validate.yaml
+++ b/.github/workflows/validate.yaml
@@ -1,12 +1,15 @@
 name: Validate
 
 on:
-  push: 
+  push:
   pull_request:
   schedule:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   validate-hacs:
     runs-on: "ubuntu-latest"
diff --git a/custom_components/rohlikcz/manifest.json b/custom_components/rohlikcz/manifest.json
index 0dd6823..1bb086d 100644
--- a/custom_components/rohlikcz/manifest.json
+++ b/custom_components/rohlikcz/manifest.json
@@ -8,5 +8,5 @@
   "iot_class": "cloud_polling",
   "issue_tracker": "https://github.com/dvejsada/HA-RohlikCZ/issues",
   "requirements": ["rohlik-api==0.3.0"],
-  "version": "1.0.0-beta4"
+  "version": "1.0.0"
 }
diff --git a/readme.md b/readme.md
index 7bac059..054e3de 100644
--- a/readme.md
+++ b/readme.md
@@ -12,9 +12,6 @@ Bring your **[Rohlík.cz](https://www.rohlik.cz)** grocery deliveries into Home
 > [!WARNING]
 > This integration uses a reverse-engineered API from the Rohlík.cz website. It is **not** officially supported by Rohlík.cz. Use it at your own risk.
 
-> [!NOTE]
-> The current release is **1.0.0-beta4**, a pre-release of the upcoming 1.0.0. It is feature-complete but still being tested — see [Installing the beta](#installing-the-beta) below, and please [report anything you run into](https://github.com/dvejsada/HA-RohlikCZ/issues).
-
 ---
 
 ## ✨ What Can You Do With This Integration?
@@ -39,20 +36,14 @@ Install in one click via the Home Assistant Community Store:
 
 > Don't have HACS yet? [Get it here](https://hacs.xyz/).
 
-#### Installing the beta
-
-HACS hides pre-releases by default, so the 1.0.0 beta will not show up until you ask for it:
+#### Trying pre-releases
 
-1. Open **Rohlík.cz** in HACS.
-2. Click **⋮ → Redownload**.
-3. Enable **Show beta versions**.
-4. Pick `v1.0.0-beta4` and download it.
-5. Restart Home Assistant.
+New versions are sometimes published as pre-releases (betas) first. HACS hides them by default; to try one, open **Rohlík.cz** in HACS, click **⋮ → Redownload**, enable **Show beta versions** and pick the version. Please [report anything you run into](https://github.com/dvejsada/HA-RohlikCZ/issues).
 
 ### Option 2 — Manual Installation
 
-1. Download the `rohlikcz` folder from the [latest release](https://github.com/dvejsada/HA-RohlikCZ/releases) — for the beta, pick the newest release marked **Pre-release**.
-2. Copy the `rohlikcz` folder into your Home Assistant `config/custom_components/` directory.
+1. Download `rohlikcz.zip` from the [latest release](https://github.com/dvejsada/HA-RohlikCZ/releases/latest).
+2. Extract it into a new `config/custom_components/rohlikcz/` directory in your Home Assistant configuration.
 3. Restart Home Assistant.
 
 ---