diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..d2acad8
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+*.o
+*.bc
diff --git a/.github/workflows/cleanup_cache.yml b/.github/workflows/cleanup_cache.yml
index d9323e6..040edcc 100644
--- a/.github/workflows/cleanup_cache.yml
+++ b/.github/workflows/cleanup_cache.yml
@@ -1,4 +1,4 @@
-name: cleanup caches by a branch
+name: Cleanup branch caches
 
 permissions: {}
 
diff --git a/.github/workflows/publish-pg_tracing-pgxn.yml b/.github/workflows/publish-pg_tracing-pgxn.yml
index 6a5d0e1..6dd7745 100644
--- a/.github/workflows/publish-pg_tracing-pgxn.yml
+++ b/.github/workflows/publish-pg_tracing-pgxn.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout Git Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/publish-pg_tracing-ubuntu.yml b/.github/workflows/publish-pg_tracing-ubuntu.yml
new file mode 100644
index 0000000..2413490
--- /dev/null
+++ b/.github/workflows/publish-pg_tracing-ubuntu.yml
@@ -0,0 +1,73 @@
+# Publish pg_tracing (Ubuntu)
+# Build and publish the pg_tracing extension as .deb to GitHub Releases.
+
+name: Publish pg_tracing (Ubuntu)
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      ext_version:
+        description: "The version to set for the pg_tracing release. This publishes the latest commit of the chosen branch and uploads it to the pre-existing GitHub Release of the provided version."
+        required: true
+        default: ""
+
+jobs:
+  publish-pg_tracing:
+    name: Publish pg_tracing for PostgreSQL ${{ matrix.pg_version }} (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        pg_version: [14, 15, 16, 17]
+        runner: [ubuntu-22.04, ubuntu-22.04-arm]
+        include:
+          - name: Ubuntu amd64 (Jammy)
+            runner: ubuntu-22.04
+            arch: amd64
+          - name: Ubuntu arm (Jammy)
+            runner: ubuntu-22.04-arm
+            arch: arm64
+
+    steps:
+      - name: Checkout Git Repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Retrieve Tag Version
+        id: retrieve_version
+        run: |
+          if [ -n "${{ github.event.inputs.ext_version }}" ]; then
+            EXT_VERSION=${{ github.event.inputs.ext_version }}
+          else
+            if [[ $GITHUB_REF == refs/tags/v* ]]; then
+              EXT_VERSION=${GITHUB_REF#refs/tags/v}
+            else
+              EXT_VERSION="0.0.0"
+            fi
+          fi
+          echo "ext_version=$EXT_VERSION" >> $GITHUB_OUTPUT
+
+      - name: Create deb Package
+        run: ARCH=${{ matrix.arch }} EXT_VERSION=${{ steps.retrieve_version.outputs.ext_version }} PG_VERSION=${{ matrix.pg_version }} make packages
+
+      - name: Sign and Attest Build Provenance
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v.2.2.3
+        with:
+          subject-path: |
+            ./tmp/postgresql-${{ matrix.pg_version }}-pg-tracing_${{ steps.retrieve_version.outputs.ext_version }}_${{ matrix.arch }}.deb
+
+      - name: Release
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v 2.2.1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: |
+            ./tmp/postgresql-${{ matrix.pg_version }}-pg-tracing_${{ steps.retrieve_version.outputs.ext_version }}_${{ matrix.arch }}.deb
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index fce9be7..3c4f7a4 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -17,10 +17,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        PG_VERSION: [14, 15, 16, 17, 18]
+        PG_VERSION: [14, 15, 16, 17]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
 
@@ -31,18 +31,18 @@ jobs:
         run: echo "::add-matcher::matcher.json"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Restore Build Image from cache
         id: cache-build-image-restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-PG-${{ matrix.PG_VERSION }}-buildx-${{ hashFiles('**/Dockerfile') }}
 
       - name: Build Docker Test Image
         id: build-test-image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           load: true
           build-args: "PG_VERSION=${{ matrix.PG_VERSION }}"
@@ -54,7 +54,7 @@ jobs:
       - name: Save Build Image in cache
         id: cache-build-image-save
         if: always() && steps.cache-build-image-restore.outputs.cache-hit != 'true' && steps.build-test-image.outcome == 'success'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-PG-${{ matrix.PG_VERSION }}-buildx-${{ hashFiles('**/Dockerfile') }}
diff --git a/common.mk b/common.mk
index 186d543..59e62b4 100644
--- a/common.mk
+++ b/common.mk
@@ -14,12 +14,14 @@ else
 PG_VERSION ?= $(lastword $(PG_VERSIONS))
 endif
 
-# Get extension version
-GIT_EXISTS := $(shell command -v git 2> /dev/null)
-ifdef GIT_EXISTS
-EXT_VERSION = $(shell git describe --tags | sed 's/^v//')
-else
-EXT_VERSION = "0.1.0"
+ifeq ($(EXT_VERSION),)
+	# Get extension version
+	GIT_EXISTS := $(shell command -v git 2> /dev/null)
+	ifdef GIT_EXISTS
+		EXT_VERSION = $(shell git describe --tags | sed 's/^v//')
+	else
+		EXT_VERSION = "0.1.0"
+	endif
 endif
 
 TMP_DIR=$(PWD)/tmp
diff --git a/packages/Makefile b/packages/Makefile
index 62c75a8..a646be5 100644
--- a/packages/Makefile
+++ b/packages/Makefile
@@ -16,5 +16,6 @@ $(TMP_DIR)/$(DEB_PACKAGE):
 	@mkdir -p $(TMP_DIR)
 	docker build --rm --platform linux/$(ARCH) \
 		$(DOCKER_BUILD_OPTS) -f deb.Dockerfile -t $(IMAGE_NAME) ..
-	docker run --rm --platform linux/$(ARCH) \
-		-v $(TMP_DIR):/out $(IMAGE_NAME) bash -c "cp /usr/src/pg_tracing/$(DEB_PACKAGE) /out"
+	docker create --name dummy $(IMAGE_NAME)
+	docker cp dummy:/usr/src/pg_tracing/$(DEB_PACKAGE) ../tmp/$(DEB_PACKAGE)
+	docker rm -f dummy
diff --git a/packages/deb.Dockerfile b/packages/deb.Dockerfile
index 42d6bf6..8096654 100644
--- a/packages/deb.Dockerfile
+++ b/packages/deb.Dockerfile
@@ -59,5 +59,3 @@ RUN fpm \
   --description "Distributed Tracing for PostgreSQL" \
   --vendor "datadoghq" --license="MIT" \
   -s dir usr
-
-VOLUME ["/out"]