diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 64eb56e..efd19ea 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -154,39 +154,15 @@ jobs:
       - name: Get result
         run: echo "${{ needs.Build.outputs.tags }}"
 
-      - name: Update versions
+      - name: Verify versions are pre-bumped
         if: startsWith(github.ref, 'refs/tags/')
         run: |
           TAG="${{ needs.Build.outputs.tags }}"
-          CURRENT_VERSION=$(grep "appVersion: " helm/easyhaproxy/Chart.yaml |  sed 's#appVersion: "\(.*\)"#\1#g')
-
-          if [ "$TAG" = "$CURRENT_VERSION" ]; then
-            echo "Skipping version $CURRENT_VERSION..."
-          elif [ "$TAG" = "latest" ]; then
-            echo "Skipping latest version..."
-          else
-            sed -i "s#easy-haproxy:[a-zA-Z0-9\.-]*#easy-haproxy:$TAG#g" deploy/docker/docker-compose.yml 
-            sed -i "s#version: \"[a-zA-Z0-9\.-]*\"#version: \"$TAG\"#g" deploy/kubernetes/easyhaproxy-*.yml 
-            sed -i "s#easy-haproxy:[a-zA-Z0-9\.-]*#easy-haproxy:$TAG#g" deploy/kubernetes/easyhaproxy-*.yml
-
-            sed -i "s#easy-haproxy/[a-zA-Z0-9\.-]*/#easy-haproxy/$TAG/#g" docs/kubernetes.md
-            sed -i "s#easy-haproxy:[a-zA-Z0-9\.-]*#easy-haproxy:$TAG#g" docs/swarm.md
-            sed -i "s#appVersion: \"[a-zA-Z0-9\.-]*\"#appVersion: \"$TAG\"#g" helm/easyhaproxy/Chart.yaml
-          
-            find examples -type f -name '*.yml' -exec sed -i "s#\(byjg/easy-haproxy:\)[a-zA-Z0-9\.-]*#\1$TAG#g" {} \; -print
-
-            VERSION=$(grep "version: " helm/easyhaproxy/Chart.yaml |  sed 's#version: ##g')
-            NEW_VERSION=$(echo $VERSION | awk -F. '/[0-9]+\./{$NF++;print}' OFS=.)
-
-            sed -i "s#version: [a-zA-Z0-9\.]*#version: $NEW_VERSION#g" helm/easyhaproxy/Chart.yaml
-            sed -i "s#chart: easyhaproxy-[a-zA-Z0-9\.]*#chart: easyhaproxy-$NEW_VERSION#g" deploy/kubernetes/easyhaproxy-*.yml 
-
-            git add .
-            git config --global user.name "$GITHUB_ACTOR CI/CD"
-            git config --global user.email "info@byjg.com.br"
-            git commit -m "[skip ci] Update from $CURRENT_VERSION to $TAG"
-            git push
+          if [ "$TAG" = "latest" ]; then
+            echo "Skipping latest tag verification"
+            exit 0
           fi
+          ./scripts/bump-version.sh --verify "$TAG"
 
   HelmDeploy:
     if: github.ref == 'refs/heads/master'
diff --git a/RELEASE.md b/RELEASE.md
index 008a242..616fa62 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -83,35 +83,32 @@ The automated release process is triggered by pushing a semantic version tag.
    docker build -t byjg/easy-haproxy:local -f build/Dockerfile .
    ```
 
-### Step 2: Create and Push a Release Tag
+### Step 2: Bump Versions (script + PR)
 
-1. **Create a new semantic version tag:**
+1. **Run the bump script from the repo root:**
    ```bash
-   # For a new minor version (new features)
-   git tag 4.7.0
+   ./scripts/bump-version.sh 5.0.0
+   ```
+   This updates image tags, docs, Helm chart `appVersion`, and bumps the chart version patch.
 
-   # For a patch version (bug fixes)
-   git tag 4.6.1
+2. **Review and commit the changes on a branch:**
+   ```bash
+   git status
+   git add .
+   git commit -m "Bump version to 5.0.0"
+   git push origin <your-branch>
+   ```
 
-   # For a major version (breaking changes)
+3. **Open a PR to `master` and merge it.** Branch protection requires merging through a PR; CI/CD no longer pushes directly.
+
+4. **Tag from `master` after the PR merges:**
+   ```bash
+   git checkout master
+   git pull
    git tag 5.0.0
+   git push origin 5.0.0
    ```
 
-2. **Push the tag to GitHub:**
-   ```bash
-   git push origin 4.7.0
-   ```
-
-3. **Monitor the GitHub Actions workflow:**
-   - Go to: https://github.com/byjg/docker-easy-haproxy/actions
-   - Watch the "Docker" workflow progress
-   - Verify all jobs complete successfully:
-     - ✅ Test
-     - ✅ Build (multi-arch)
-     - ✅ Helm
-     - ✅ HelmDeploy
-     - ✅ Documentation
-
 ### Step 3: What Happens Automatically
 
 When you push a semantic version tag, GitHub Actions will:
@@ -125,16 +122,9 @@ When you push a semantic version tag, GitHub Actions will:
    - Tag image with version number (e.g., `byjg/easy-haproxy:4.7.0`)
    - Push to Docker Hub
 
-3. **Update Versions** (`Helm` job):
-   - Update `helm/easyhaproxy/Chart.yaml`:
-     - `appVersion`: Set to new version (e.g., `4.7.0`)
-     - `version`: Auto-increment patch version (e.g., `0.1.9` → `0.1.10`)
-   - Update all version references in:
-     - `deploy/docker/docker-compose.yml`
-     - `deploy/kubernetes/easyhaproxy-*.yml`
-     - `docs/kubernetes.md`
-     - `examples/*/*.yml`
-   - Commit and push changes with message: `[skip ci] Update from X.Y.Z to A.B.C`
+3. **Verify Versions** (`Helm` job):
+   - Ensures the repository already contains the tag version via `./scripts/bump-version.sh --verify <tag>`
+   - Fails fast if the repo was not prepared before tagging (no auto-commits)
 
 4. **Publish Helm Chart** (`HelmDeploy` job):
    - Package Helm chart
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
new file mode 100755
index 0000000..49b589c
--- /dev/null
+++ b/scripts/bump-version.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/bump-version.sh <new-version>
+  scripts/bump-version.sh --verify <new-version>
+
+Description:
+  Updates all version references (images, docs, Helm chart) to <new-version>
+  and bumps the Helm chart version patch. Use --verify to check the repo is
+  already updated for <new-version> (no changes are made).
+EOF
+}
+
+MODE="apply"
+if [[ "${1:-}" == "--verify" ]]; then
+  MODE="verify"
+  shift
+fi
+
+NEW_VERSION="${1:-}"
+if [[ -z "$NEW_VERSION" ]]; then
+  usage
+  exit 1
+fi
+
+if [[ "$NEW_VERSION" == "latest" ]]; then
+  echo "Skipping 'latest' tag."
+  exit 0
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+CHART_FILE="helm/easyhaproxy/Chart.yaml"
+CURRENT_APP_VERSION=$(grep 'appVersion:' "$CHART_FILE" | head -1 | awk -F'"' '{print $2}')
+CURRENT_CHART_VERSION_RAW=$(grep '^version:' "$CHART_FILE" | head -1 | awk '{print $2}')
+# Normalize chart version (strip trailing dots/spaces)
+CURRENT_CHART_VERSION="${CURRENT_CHART_VERSION_RAW%%.}"
+
+if [[ "$MODE" == "verify" ]]; then
+  echo "Verifying repository is prepared for version $NEW_VERSION..."
+  STATUS=0
+
+  check_contains() {
+    local pattern="$1" file="$2" note="$3"
+    if ! grep -q "$pattern" "$file"; then
+      echo "❌ $note ($file)"
+      STATUS=1
+    else
+      echo "✅ $note ($file)"
+    fi
+  }
+
+  check_contains "appVersion: \"$NEW_VERSION\"" "$CHART_FILE" "Chart appVersion"
+  check_contains "version: \"$NEW_VERSION\"" deploy/kubernetes/easyhaproxy-daemonset.yml "K8s daemonset manifest version"
+  check_contains "easy-haproxy:$NEW_VERSION" deploy/kubernetes/easyhaproxy-daemonset.yml "K8s daemonset image tag"
+  check_contains "easy-haproxy:$NEW_VERSION" deploy/docker/docker-compose.yml "Docker compose image tag"
+
+  if grep -R "byjg/easy-haproxy:" examples | grep -v "$NEW_VERSION" >/dev/null; then
+    echo "❌ Examples still reference a different tag. Run bump-version.sh to update."
+    STATUS=1
+  else
+    echo "✅ Examples reference $NEW_VERSION"
+  fi
+
+  exit $STATUS
+fi
+
+echo "Updating repository to version $NEW_VERSION (previous appVersion: $CURRENT_APP_VERSION, chart version: $CURRENT_CHART_VERSION)"
+
+# Update deployment manifests and docs
+sed -i "s#easy-haproxy:[a-zA-Z0-9\\.-]*#easy-haproxy:$NEW_VERSION#g" deploy/docker/docker-compose.yml
+sed -i "s#version: \"[a-zA-Z0-9\\.-]*\"#version: \"$NEW_VERSION\"#g" deploy/kubernetes/easyhaproxy-*.yml
+sed -i "s#easy-haproxy:[a-zA-Z0-9\\.-]*#easy-haproxy:$NEW_VERSION#g" deploy/kubernetes/easyhaproxy-*.yml
+sed -i "s#easy-haproxy/[a-zA-Z0-9\\.-]*/#easy-haproxy/$NEW_VERSION/#g" docs/kubernetes.md
+sed -i "s#easy-haproxy:[a-zA-Z0-9\\.-]*#easy-haproxy:$NEW_VERSION#g" docs/swarm.md
+sed -i "s/^\\*\\*Current Version:\\*\\* \`[^\`]*\`/**Current Version:** \`$NEW_VERSION\`/" RELEASE.md
+sed -i "s/^\\*\\*App Version:\\*\\* \`[^\`]*\`/**App Version:** \`$NEW_VERSION\`/" RELEASE.md
+
+# Update Helm appVersion
+sed -i "s#appVersion: \"[a-zA-Z0-9\\.-]*\"#appVersion: \"$NEW_VERSION\"#g" "$CHART_FILE"
+
+# Update examples
+find examples -type f -name '*.yml' -exec sed -i "s#\\(byjg/easy-haproxy:\\)[a-zA-Z0-9\\.-]*#\\1$NEW_VERSION#g" {} \; -print
+# Update raw GitHub URLs in Kubernetes examples
+find examples/kubernetes -type f -name '*.yml' -exec sed -i "s#raw.githubusercontent.com/byjg/docker-easy-haproxy/[0-9\\.\\-]*/deploy/kubernetes/easyhaproxy-daemonset.yml#raw.githubusercontent.com/byjg/docker-easy-haproxy/$NEW_VERSION/deploy/kubernetes/easyhaproxy-daemonset.yml#g" {} \;
+
+# Bump chart version (patch)
+SANITIZED_CHART_VERSION="${CURRENT_CHART_VERSION%\.}"
+IFS='.' read -r -a _parts <<< "$SANITIZED_CHART_VERSION"
+if [[ "${#_parts[@]}" -lt 1 ]] || ! [[ "${_parts[-1]}" =~ ^[0-9]+$ ]]; then
+  echo "Invalid chart version '$CURRENT_CHART_VERSION'"
+  exit 1
+fi
+last_index=$((${#_parts[@]} - 1))
+_parts[$last_index]=$(( ${_parts[$last_index]} + 1 ))
+NEXT_CHART_VERSION=$(IFS='.'; echo "${_parts[*]}")
+sed -i -E "s/^version: .*/version: $NEXT_CHART_VERSION/" "$CHART_FILE"
+sed -i -E "s/helm\\.sh\\/chart: easyhaproxy-[0-9\\.]+/helm.sh\\/chart: easyhaproxy-$NEXT_CHART_VERSION/" deploy/kubernetes/easyhaproxy-*.yml
+
+echo "Done. Updated appVersion to $NEW_VERSION and chart version to $NEXT_CHART_VERSION."
+echo "Next steps:"
+echo "  1) git status (review changes)"
+echo "  2) git add ."
+echo "  3) git commit -m \"Bump version to $NEW_VERSION (chart $NEXT_CHART_VERSION)\""
+echo "  4) Open a PR to master and merge via PR."