diff --git a/.github/workflows/docs-version.yml b/.github/workflows/docs-version.yml
deleted file mode 100644
index 3f18a448..00000000
--- a/.github/workflows/docs-version.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-name: "Docs Version Update"
-
-on:
-  push:
-    tags:
-      - '*'
-
-jobs:
-  bump-version-in-docs:
-    runs-on: ubuntu-latest
-    steps:
-
-      - uses: actions/checkout@v3
-        name: checkout repo
-        with:
-          ref: "refs/heads/master"
-
-      - run: sed -i "s|^\\(git clone.*--branch \\).*$|\\1v$(cat version.txt)|" docs/guide/getting-started.md
-        name: replace version in docs
-
-      - uses: stefanzweifel/git-auto-commit-action@v4
-        name: commit docs version update
-        with:
-          commit_message: "docs: update version in install instructions"
diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml
new file mode 100644
index 00000000..5f65cf17
--- /dev/null
+++ b/.github/workflows/on-release.yml
@@ -0,0 +1,23 @@
+name: On Release
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  bump-versions-in-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout repo
+        uses: actions/checkout@v3
+        with:
+          ref: "refs/heads/master"
+      - name: replace version in getting-started docs
+        run: scripts/update_version_in_docs.bash
+      - name: replace version in security policy support list
+        run: scripts/update_version_list_in_security_policy.bash
+      - name: commit docs version update
+        uses: stefanzweifel/git-auto-commit-action@v4
+        with:
+          commit_message: "docs: update version in install instructions & security policy"
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 99e64c5d..b40b3782 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -7,7 +7,6 @@ on:
   pull_request:
 
 env:
-  BATS_VERSION: v1.7.0
   ELVISH_VERSION: v0.18.0
 
 jobs:
@@ -50,7 +49,7 @@ jobs:
 
       - name: Install bats
         run: |
-          git clone --depth 1 --branch "${{ env.BATS_VERSION }}" https://github.com/bats-core/bats-core.git $HOME/bats-core
+          git clone --depth 1 --branch "v$(grep -Eo "^\\s*bats\\s*.*$" ".tool-versions" | cut -d ' ' -f2-)" https://github.com/bats-core/bats-core.git $HOME/bats-core
           echo "$HOME/bats-core/bin" >>"$GITHUB_PATH"
 
       - name: Run tests
diff --git a/scripts/shellcheck.bash b/scripts/shellcheck.bash
index 4d03917e..5249e8e4 100755
--- a/scripts/shellcheck.bash
+++ b/scripts/shellcheck.bash
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 exec shellcheck -s bash -x \
   asdf.sh \
   completions/*.bash \
diff --git a/scripts/shfmt.bash b/scripts/shfmt.bash
index 534f8a6d..461d7a53 100755
--- a/scripts/shfmt.bash
+++ b/scripts/shfmt.bash
@@ -1,3 +1,5 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 exec shfmt -d .
diff --git a/scripts/update_version_in_docs.bash b/scripts/update_version_in_docs.bash
new file mode 100755
index 00000000..4a0d2f29
--- /dev/null
+++ b/scripts/update_version_in_docs.bash
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+version=$(cat version.txt)
+sed -i "s/\\(git clone.*--branch \\).*\\(\`.*|\\)/\\1v$version\\2/" docs/guide/getting-started.md
diff --git a/scripts/update_version_list_in_security_policy.bash b/scripts/update_version_list_in_security_policy.bash
new file mode 100755
index 00000000..3361bbb4
--- /dev/null
+++ b/scripts/update_version_list_in_security_policy.bash
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+version_major_minor_x="$(cut -f1-2 -d "." version.txt).x"
+
+# skip if version is already in the list
+if ! grep -q "$version_major_minor_x" SECURITY.md; then
+  # prepend new version to the list
+  sed -i "s/white_check_mark:/x:               /g" SECURITY.md
+  sed -i "s/^\\(| -* | -* |\\)$/\\1\\n| $version_major_minor_x  | :white_check_mark: |/" SECURITY.md
+fi