diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 91e8d18d8..52c3b0b01 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ on:
         description: 'Update CHANGELOG'
         required: true
         type: boolean
-        default: true
+        default: false
       notification-channel:
         description: 'Slack channel to use for notifications'
         required: false
@@ -22,12 +22,47 @@ env:
   GO_TAGS: "release"
 
 jobs:
-  get-go-version:
+  prepare-release:
     runs-on: ubuntu-latest
     outputs:
-      go-version: ${{ steps.get-go-version.outputs.go-version }}
+      build-ref: ${{ steps.commit-change-push.outputs.build-ref }}
     steps:
+      - name: Prevent running from main
+        if: ${{ github.ref_name == 'main' }}
+        run: |
+          echo "::error::Workflow not allowed to run from ${{ github.ref_name }}"
+          exit 1
+
+      - name: Print release info
+        run: |
+          echo "::notice::Release v${{ github.event.inputs.version }} from branch ${{ github.ref_name }}"
+
+      - name: Install semver CLI
+        run: |
+          local_bin="${HOME}/.local/bin"
+          mkdir -p "${local_bin}"
+          curl -L --output "${local_bin}/semver" \
+            https://raw.githubusercontent.com/fsaintjacques/semver-tool/3.3.0/src/semver
+          chmod +x "${local_bin}/semver"
+          echo "${local_bin}" >> $GITHUB_PATH
+
+      - name: Validate release version
+        run: |
+          if [ "$(semver validate ${{ github.event.inputs.version }})" == "invalid" ]; then
+            echo "::error::Version ${{ github.event.inputs.version }} is invalid"
+            exit 1
+          fi
+
       - uses: actions/checkout@v2
+
+      - name: Setup Git
+        run: |
+          if [ "${{ secrets.ELEVATED_GITHUB_TOKEN }}" ]; then
+            git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com/".insteadOf "https://github.com"
+          fi
+          git config --global user.email "github-team-nomad-core@hashicorp.com"
+          git config --global user.name "hc-github-team-nomad-core"
+
       - name: Determine Go version
         id: get-go-version
         # We use .go-version as our source of truth for current Go
@@ -36,18 +71,10 @@ jobs:
           echo "Building with Go $(cat .go-version)"
           echo "::set-output name=go-version::$(cat .go-version)"
 
-  prepare-release:
-    needs: get-go-version
-    runs-on: ubuntu-latest
-    outputs:
-      build-ref: ${{ steps.commit-change-push.outputs.build-ref }}
-    steps:
-      - uses: actions/checkout@v2
-
       - name: Setup go
         uses: actions/setup-go@v2
         with:
-          go-version: ${{ needs.get-go-version.outputs.go-version }}
+          go-version: ${{ steps.get-go-version.outputs.go-version }}
 
       - name: Setup node and yarn
         uses: actions/setup-node@v2
@@ -64,6 +91,7 @@ jobs:
           make deps
 
       - name: Update notification channel
+        id: notification-channel
         if: ${{ github.event.inputs.notification-channel != '' }}
         run: |
           sed -i.bak -e 's|\(notification_channel * = *"\)[^"]*|\1${{ github.event.inputs.notification-channel }}|g' .release/ci.hcl
@@ -73,8 +101,8 @@ jobs:
       - name: Update version file
         run: |
           NOMAD_VERSION="${{ github.event.inputs.version }}"
-          NOMAD_MAIN_VERSION=$(echo "$NOMAD_VERSION" | cut -d- -f1)
-          NOMAD_PRERELEASE_VERSION=$(echo "$NOMAD_VERSION" | sed 's|^[^-]*-\{0,1\}||g')
+          NOMAD_MAIN_VERSION=$(semver get release "$NOMAD_VERSION")
+          NOMAD_PRERELEASE_VERSION=$(semver get prerel "$NOMAD_VERSION")
 
           echo "updating version to ${NOMAD_MAIN_VERSION}-${NOMAD_PRERELEASE_VERSION}"
 
@@ -103,10 +131,7 @@ jobs:
         run: |
           git add -A .
           find . -name '*.generated.go' -not -path './vendor/*' -exec git add -f '{}' \;
-          if ! git diff-index --quiet HEAD --;
-          then
-            git config --global user.email "github-team-nomad-core@hashicorp.com"
-            git config --global user.name "hc-github-team-nomad-core"
+          if ! git diff-index --quiet HEAD --; then
             git commit --message "Generate files for ${{ github.event.inputs.version }} release"
             git push origin "$(git rev-parse --abbrev-ref HEAD)"
             echo "committing generated files"
@@ -122,3 +147,53 @@ jobs:
           token: ${{ secrets.ELEVATED_GITHUB_TOKEN}}
           inputs: '{"build-ref": "${{ steps.commit-change-push.outputs.build-ref }}", "make-prerelease": "false"}'
           ref: ${{ needs.prepare-release.outputs.build-ref }}
+
+      - name: Revert notification channel
+        if: ${{ github.event.inputs.notification-channel != '' }}
+        run: |
+          git reset ${{ github.sha }} -- .release/ci.hcl
+
+          # git reset will place the original file content in the staging area
+          # and leave the changes since then unstaged, so call git restore to
+          # discard these changes and use --cached to display the diff in the
+          # staging area.
+          git restore .release/ci.hcl
+          git diff --cached --color=always .release/ci.hcl
+
+      - name: Update version file
+        run: |
+          # Only bump the Version value if this is not a pre-release.
+          # For final releases we want `nomad -version` to display the next
+          # version to indicate that the current release is done.
+          if [ -z "$(semver get prerel ${{ github.event.inputs.version }})" ]; then
+            next_version=$(semver bump patch ${{ github.event.inputs.version }})
+            sed -i.bak -e "s|\(Version * = *\"\)[^\"]*|\1${next_version}|g" version/version.go
+          fi
+          # Set the VersionPrerelease variable back to dev.
+          sed -i.bak -e "s|\(VersionPrerelease * = *\"\)[^\"]*|\1dev|g" version/version.go
+          rm -rf version/version.go.bak
+          git diff --color=always version/version.go
+
+      - name: Update LAST_RELEASE
+        run: |
+          # LAST_RELEASE is used to generate the new CHANGELOG entries, so it's
+          # only updated for final releases.
+          if [ -z "$(semver get prerel ${{ github.event.inputs.version }})" ]; then
+            sed -i.bak -re "s|^(LAST_RELEASE\s+\?=\s+v).*$|\1${{ github.event.inputs.version }}|g" GNUmakefile
+            rm -fr GNUmakefile.bak
+            git diff --color=always GNUmakefile
+          else
+            echo "Version ${{ github.event.inputs.version }} is a prerelease, skipping update of LAST_RELEASE"
+          fi
+
+      - name: Commit post-release changes
+        run: |
+          # Display stated and unstaged diffs.
+          git diff --color=always HEAD
+          git add -A .
+          if ! git diff-index --quiet HEAD --; then
+            git commit --message 'Prepare for next release'
+            git push origin "$(git rev-parse --abbrev-ref HEAD)"
+          else
+            echo "no files were updated"
+          fi
diff --git a/.release/ci.hcl b/.release/ci.hcl
index 4e8127728..74118631a 100644
--- a/.release/ci.hcl
+++ b/.release/ci.hcl
@@ -3,10 +3,7 @@ schema = "1"
 project "nomad" {
   team = "nomad"
   slack {
-    // #feed-nomad-releases
     notification_channel = "C03B5EWFW01"
-    // #proj-nomad-releases
-    // notification_channel = "CUYKT2A73"
   }
   github {
     organization = "hashicorp"