diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f98a21d..e5e2eb8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -324,6 +324,14 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+
       - name: Check branches and verify merge readiness
         id: check-branches
         env:
@@ -370,7 +378,23 @@ jobs:
           GH_TOKEN: ${{ secrets.CI_CD_PAT }}
         run: |
           set -e
-          VERSION="${{ github.event.inputs.new_version }}"
+          # Read version from pyproject.toml (single source of truth)
+          if ! VERSION="$(poetry version -s 2>&1)"; then
+            echo "::error::Failed to read version from pyproject.toml"
+            echo "::error::Poetry output: $VERSION"
+            exit 1
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::Version is empty in pyproject.toml"
+            exit 1
+          fi
+          # Validate semver format
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?$ ]]; then
+            echo "::error::Invalid version format in pyproject.toml: $VERSION"
+            echo "::error::Expected semantic version format (e.g., 1.2.3, 1.2.3-beta.1, 1.2.3+build.123)"
+            exit 1
+          fi
+          echo "Using version from pyproject.toml: $VERSION"
 
           # Create PR with auto-merge enabled
           PR_URL=$(gh pr create \
@@ -643,7 +667,22 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="$(poetry version -s)"
+          if ! VERSION="$(poetry version -s 2>&1)"; then
+            echo "::error::Failed to read version from pyproject.toml"
+            echo "::error::Poetry output: $VERSION"
+            exit 1
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::Version is empty in pyproject.toml"
+            exit 1
+          fi
+          # Validate semver format
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?$ ]]; then
+            echo "::error::Invalid version format in pyproject.toml: $VERSION"
+            echo "::error::Expected semantic version format (e.g., 1.2.3, 1.2.3-beta.1, 1.2.3+build.123)"
+            exit 1
+          fi
+          echo "Using version: $VERSION"
           PKG_DIR="pkg_dist_debian"
           mkdir -p dist
           echo "Packaging from $PKG_DIR"
@@ -759,7 +798,21 @@ jobs:
             -e FPM_VERSION=${{ env.FPM_VERSION }} \
             ghcr.io/jmr-dev/android-file-handler-arch-builder:latest \
             sh -c 'set -euo pipefail && \
-            VERSION="$(poetry version -s)" && \
+            if ! VERSION="$(poetry version -s 2>&1)"; then \
+              echo "::error::Failed to read version from pyproject.toml" >&2 && \
+              echo "::error::Poetry output: $VERSION" >&2 && \
+              exit 1; \
+            fi && \
+            if [ -z "$VERSION" ]; then \
+              echo "::error::Version is empty in pyproject.toml" >&2 && \
+              exit 1; \
+            fi && \
+            if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?$ ]]; then \
+              echo "::error::Invalid version format in pyproject.toml: $VERSION" >&2 && \
+              echo "::error::Expected semantic version format (e.g., 1.2.3, 1.2.3-beta.1, 1.2.3+build.123)" >&2 && \
+              exit 1; \
+            fi && \
+            echo "Using version: $VERSION" && \
             PKG_DIR="pkg_dist_arch" && \
             mkdir -p dist && \
             echo "Packaging from $PKG_DIR" && \
@@ -867,7 +920,22 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="$(poetry version -s)"
+          if ! VERSION="$(poetry version -s 2>&1)"; then
+            echo "::error::Failed to read version from pyproject.toml"
+            echo "::error::Poetry output: $VERSION"
+            exit 1
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::Version is empty in pyproject.toml"
+            exit 1
+          fi
+          # Validate semver format
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?$ ]]; then
+            echo "::error::Invalid version format in pyproject.toml: $VERSION"
+            echo "::error::Expected semantic version format (e.g., 1.2.3, 1.2.3-beta.1, 1.2.3+build.123)"
+            exit 1
+          fi
+          echo "Using version: $VERSION"
           PKG_DIR="pkg_dist_rhel"
           mkdir -p dist
           echo "Packaging from $PKG_DIR (version=$VERSION)"
@@ -1033,7 +1101,24 @@ jobs:
 
       - name: Get version
         id: version
-        run: echo "version=$(poetry version -s)" >> $GITHUB_OUTPUT
+        run: |
+          if ! VERSION="$(poetry version -s 2>&1)"; then
+            echo "::error::Failed to read version from pyproject.toml"
+            echo "::error::Poetry output: $VERSION"
+            exit 1
+          fi
+          if [ -z "$VERSION" ]; then
+            echo "::error::Version is empty in pyproject.toml"
+            exit 1
+          fi
+          # Validate semver format
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?(\+[a-zA-Z0-9]+(\.[a-zA-Z0-9]+)*)?$ ]]; then
+            echo "::error::Invalid version format in pyproject.toml: $VERSION"
+            echo "::error::Expected semantic version format (e.g., 1.2.3, 1.2.3-beta.1, 1.2.3+build.123)"
+            exit 1
+          fi
+          echo "Using version: $VERSION"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4