diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index dd13f264..a0a606b9 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,7 +1,9 @@
 name: Build Docker Image
 
 on:
-  push:
+  workflow_run:
+    workflows: [ "Publish a new release" ]
+    types: [ completed ]
     branches: [ "stable" ]
 
 env:
@@ -13,9 +15,10 @@ env:
 jobs:
 
   # The image needs the Linux executable, which is not committed to the repository. This
-  # workflow runs on pushes to `stable`, after publish-release.yml has published the
-  # artifacts, so it takes the executable from the release rather than rebuilding it.
+  # workflow runs after publish-release.yml has successfully published the artifacts, so
+  # it takes the executable from that exact release rather than rebuilding it.
   build-docker-image:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
 
     permissions:
@@ -24,14 +27,29 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+
+      # Get the version from the exact commit published by the triggering workflow.
+      - name: Get current version
+        run: |
+          set -euo pipefail
+
+          version="$(php ./bin/get-release-version.php)"
+          echo "VERSION=$version" >> "$GITHUB_ENV"
 
       - name: Download the published Linux executable
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
+
           mkdir -p builds
-          gh release download --repo "${{ github.repository }}" --pattern hyde-linux-x86_64 --dir builds
+          gh release download "v${VERSION}" \
+            --repo "${{ github.repository }}" \
+            --pattern "hyde-linux-x86_64" \
+            --dir builds
           chmod +x builds/hyde-linux-x86_64
 
       # Install the cosign tool
@@ -56,11 +74,6 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Get the current version
-      - name: Get current version
-        id: get-version
-        run: echo "VERSION=$(php ./bin/get-release-version.php)" >> $GITHUB_ENV
-
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 92b66a89..e1d2ab66 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -17,16 +17,65 @@ jobs:
     runs-on: ubuntu-latest
     name: Merge stable branch into master
 
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: master
+    permissions:
+      contents: write
+      pull-requests: write
 
-      - name: Merge stable branch into master
+    env:
+      GH_TOKEN: ${{ github.token }}
+
+    steps:
+      - name: Create or reuse stable-to-master pull request
         run: |
-          git fetch origin stable:stable
-          git merge stable
-          git push origin master
+          set -euo pipefail
+
+          find_sync_pr() {
+            gh pr list \
+              --repo "$GITHUB_REPOSITORY" \
+              --base master \
+              --head stable \
+              --state open \
+              --limit 1 \
+              --json number \
+              --jq '.[0].number // empty'
+          }
+
+          pr_number="$(find_sync_pr)"
+
+          if [[ -z "$pr_number" ]]; then
+            ahead_count="$(gh api \
+              "repos/$GITHUB_REPOSITORY/compare/master...stable" \
+              --jq '.ahead_by')"
+
+            if [[ ! "$ahead_count" =~ ^[0-9]+$ ]]; then
+              echo "Failed to compare the stable and master branches." >&2
+              exit 1
+            fi
+
+            if [[ "$ahead_count" == "0" ]]; then
+              echo "The stable branch is already fully synced to master."
+              exit 0
+            fi
+
+            if ! gh pr create \
+              --repo "$GITHUB_REPOSITORY" \
+              --base master \
+              --head stable \
+              --title "Merge stable branch into master" \
+              --body "Automatically sync the stable release branch back into master after publishing a release."; then
+              echo "Pull request creation failed; checking whether another run created it." >&2
+            fi
+
+            pr_number="$(find_sync_pr)"
+          fi
+
+          if [[ -z "$pr_number" ]]; then
+            echo "Failed to find the stable-to-master pull request." >&2
+            exit 1
+          fi
+
+          echo "Submitting pull request #$pr_number to the master merge queue."
+          gh pr merge "$pr_number" --repo "$GITHUB_REPOSITORY"
 
   build:
     uses: ./.github/workflows/build-native-all.yml
diff --git a/app/Application.php b/app/Application.php
index b91924b1..d659765d 100644
--- a/app/Application.php
+++ b/app/Application.php
@@ -21,7 +21,7 @@ class Application extends \Hyde\Foundation\Application
      * framework version. The 0.11.x CLI line embeds and supports the unreleased HydePHP
      * v3 development line, but the two versions must never be made to track each other.
      */
-    final public const APP_VERSION = '0.10.13';
+    final public const APP_VERSION = '0.11.0';
 
     /**
      * Get the path to the cached packages.php file.
diff --git a/tests/Unit/ApplicationTest.php b/tests/Unit/ApplicationTest.php
index 42d5ec9c..47ed5b2b 100644
--- a/tests/Unit/ApplicationTest.php
+++ b/tests/Unit/ApplicationTest.php
@@ -11,7 +11,7 @@
 });
 
 test('the CLI is versioned independently of the framework', function () {
-    expect(Application::APP_VERSION)->toBe('0.10.13');
+    expect(Application::APP_VERSION)->toBe('0.11.0');
 });
 
 test('custom application extends Hyde application', function () {