diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 42ba75b..9c83a0e 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -6,6 +6,13 @@ on:
     branches:
       - main
 
+permissions:
+  contents: write   # Required for pushing commits and tags
+
+concurrency:
+  group: bump-version-main
+  cancel-in-progress: false
+
 jobs:
   bump-version:
     runs-on: ubuntu-latest
@@ -16,8 +23,7 @@ jobs:
       - name: Checkout repo
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0           # Needed to create tags and see full history
-          persist-credentials: true # Needed for pushing commits and tags
+          fetch-depth: 0   # Needed to create tags and see full history
 
       # --- Step 2: Set up Python ---
       - name: Set up Python
@@ -29,70 +35,72 @@ jobs:
       - name: Calculate version
         id: calc
         run: |
-          # Call custom version calculation script
           VERSION=$(python scripts/get_version.py)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Computed version: $VERSION"
 
       # --- Step 4: Skip workflow for development versions ---
       - name: Skip if version contains 'dev'
+        if: contains(steps.calc.outputs.version, 'dev')
         run: |
-          # Exit workflow early if the version contains 'dev'
-          if [[ "${{ steps.calc.outputs.version }}" == *dev* ]]; then
-            echo "Version contains 'dev', skipping bump version workflow."
-            exit 0
-          fi
+          echo "Version contains 'dev'. Skipping release-related steps."
 
       # --- Step 5: Update files and commit if necessary ---
       - name: Update files and commit
+        id: commit_release
+        if: "!contains(steps.calc.outputs.version, 'dev')"
         run: |
-          # Define files to update
+          git config user.name "github-actions"
+          git config user.email "actions@github.com"
+
+          # Files that contain the version string
           UPDATE_FILES="config.yaml .env"
 
-          # Call general Python version replacement script
+          # Update versions
           python scripts/update_version.py "${{ steps.calc.outputs.version }}" $UPDATE_FILES
 
           # Commit changes if any
-          git config user.name "github-actions"
-          git config user.email "actions@github.com"
           git add $UPDATE_FILES
 
           if git diff --cached --quiet; then
             echo "No files changed. Skipping commit."
+            echo "committed=false" >> "$GITHUB_OUTPUT"
           else
             git commit -m "chore: bump version to ${{ steps.calc.outputs.version }}"
             git push
+            echo "committed=true" >> "$GITHUB_OUTPUT"
           fi
 
       # --- Step 6: Create release tag ---
       - name: Create release tag if it does not exist
         id: tagging
+        if: steps.commit_release.outputs.committed == 'true'
         run: |
           TAG="v${{ steps.calc.outputs.version }}"
 
           if git rev-parse --verify "$TAG" >/dev/null 2>&1; then
             echo "Tag $TAG already exists. Skipping tag creation."
-            echo "created=false" >> $GITHUB_OUTPUT
           else
-            git tag -a "v${{ steps.calc.outputs.version }}" -m "Release ${{ steps.calc.outputs.version }}"
-            git push origin "v${{ steps.calc.outputs.version }}"
-            echo "created=true" >> $GITHUB_OUTPUT
+            git tag -a "$TAG" -m "Release ${{ steps.calc.outputs.version }}"
+            git push origin "$TAG"
           fi
 
       # --- Step 7: Bump to development version ---
       - name: Bump dev version
         id: bump_dev
+        if: steps.commit_release.outputs.committed == 'true'
         run: |
+          git config user.name "github-actions"
+          git config user.email "actions@github.com"
+
           VERSION_BASE=$(python scripts/bump_dev_version.py | tail -n1)
           if [ -z "$VERSION_BASE" ]; then
             echo "Error: bump_dev_version.py returned an empty version."
             exit 1
           fi
-          echo "version_base=$VERSION_BASE" >> $GITHUB_OUTPUT
 
-          git config user.name "github-actions"
-          git config user.email "actions@github.com"
           git add src/akkudoktoreos/core/version.py
+
           if git diff --cached --quiet; then
             echo "version.py not changed. Skipping commit."
           else