diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ec16d0c4c382a94ca81e242a866ca5bda8c0fb67..f02c69ae77e91333e0a96da37a580424894d0f83 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,8 +1,12 @@
 stages:
   - lint
+  - dev_deploy
+  - dev_workflows
+  - dev_merge
   - get_images
   - update_values
   - package_publish
+  - release
 
 default:
   image: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/docker:20.10.16
@@ -30,8 +34,126 @@ lint:
     - cd charts
     - helm dep build hypo
     - helm lint hypo
-  #rules:
-  #  - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "schedule"'
+  except:
+    - main
+    - tags
+
+
+dev_deploy_job:
+  stage: dev_deploy
+  image:
+    name: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/python-argocd:3.9
+    pull_policy: [always, if-not-present]
+
+  before_script:
+    - mkdir -p /tmp/bin
+    - export PATH="/tmp/bin:$PATH"
+
+    # Install age
+    - curl -L -o /tmp/age.tar.gz https://github.com/FiloSottile/age/releases/download/v1.2.1/age-v1.2.1-linux-amd64.tar.gz
+    - tar -xzf /tmp/age.tar.gz -C /tmp
+    - mv /tmp/age/age /tmp/age/age-keygen /tmp/bin/
+
+    # Install sops
+    - curl -L -o /tmp/bin/sops https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64
+    - chmod +x /tmp/bin/sops
+
+    - sops --version
+    - age --version
+
+    # Git configuration
+    - git config --global user.email "$GITLAB_USER_EMAIL"
+    - git config --global user.name "$GITLAB_USER_NAME"
+
+    # Authenticate Git using the Group Access Token
+    - git remote set-url origin "https://${GITLAB_USER_NAME}:${GROUP_ACCESS_TOKEN}@labs.etsi.org/rep/osl/hypo/code/org.etsi.osl.hypo.ops/installer.git"
+
+    # Checkout GitOps branch
+    - git fetch origin gitops-cd
+    - git checkout gitops-cd
+    - git pull origin gitops-cd
+
+    # SOPS key
+    - echo "$SOPS_AGE_KEY_PRIVATE" > ~/.sops-age-key.txt
+    - chmod 600 ~/.sops-age-key.txt
+    - export SOPS_AGE_KEY_FILE=~/.sops-age-key.txt
+
+  script:
+    # Decrypt values
+    - sops --decrypt charts/hypo/values-cd.enc.yaml > charts/hypo/values-cd.yaml
+
+    # Update Helm values
+    - python3 scripts/helm_update_etsi.py $DEV_PORTAL_CART_IMAGE $DEV_TMF_API_IMAGE $DEV_SONATA_CORE_IMAGE $DEV_SONATA_HELM_IMAGE $DEV_SONATA_OSS_IMAGE $DEV_TELEMETRY_IMAGE $DEV_PEERING_IMAGE $DEV_REGISTRY_IMAGE $DEV_FABRIC_IMAGE $DEV_PORTAL
+
+    # Encrypt values again
+    - sops --encrypt --age "$SOPS_AGE_KEY_PUBLIC" charts/hypo/values-cd.yaml > charts/hypo/values-cd.enc.yaml
+
+    # Cleanup
+    - rm -f charts/hypo/values-cd.yaml ~/.sops-age-key.txt
+
+    # Commit & Push
+    - git add charts/hypo/values-cd.enc.yaml
+
+    - |
+      if git diff --cached --quiet; then
+        echo "No changes to commit."
+      else
+        git commit -m "Update values.yaml for GitOps CD [skip ci]"
+        git push origin HEAD:gitops-cd
+      fi
+
+    # Sync ArgoCD
+    - |
+      set -e
+      argocd login "$ARGOCD_SERVER" \
+        --username "$ARGOCD_USERNAME" \
+        --password "$ARGOCD_PASSWORD" \
+        --insecure
+
+      argocd app get hypo --refresh >/dev/null
+      argocd app wait hypo --sync --health --timeout 120
+
+      echo "Argo CD application 'hypo' is synced and healthy."
+
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+
+
+
+dev_workflows_job:
+  stage: dev_workflows
+  image: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/maven:3.9-eclipse-temurin-17
+  before_script:
+    # clone the integration tests repo
+    - git clone --depth 1 "https://oauth2:$GROUP_ACCESS_TOKEN@$INTEGRATION_REPO"
+    - cd integration.tests
+  script:
+    - mvn -B -q test "-Dkarate.env=$KARATE_ENV" "-Dkarate.options=--tags @smoke-e2e-workflow-private"
+  dependencies:
+    - dev_deploy_job
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+
+
+dev_merge:
+  stage: dev_merge
+  image:
+    name: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/alpine:latest
+    pull_policy: [always, if-not-present]
+  script:
+    - git config --global user.email "$GITLAB_USER_EMAIL"
+    - git config --global user.name "$GITLAB_USER_NAME"
+    - git remote set-url origin "https://${GITLAB_USER_NAME}:${GROUP_ACCESS_TOKEN}@labs.etsi.org/rep/osl/hypo/code/org.etsi.osl.hypo.ops/installer.git"
+
+    - git fetch origin main
+    - git fetch origin gitops-cd
+
+    - git checkout gitops-cd
+    - git pull origin gitops-cd
+    - git merge origin/main -m "Merge changes from main"
+    - git push origin gitops-cd
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
 
 
 get_images:
@@ -73,8 +195,12 @@ get_images:
   artifacts:
     paths:
       - build.env
-  #rules:
-  #  - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    refs:
+      - main
+      - gitops-cd
+    variables:
+      - '$CI_COMMIT_MESSAGE =~ /^release:\s\d/'
 
 
 update_values:
@@ -125,8 +251,12 @@ update_values:
   #artifacts:
   #  paths:
   #    - skip.env
-  #rules:
-  #  - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    refs:
+      - main
+      - gitops-cd
+    variables:
+      - '$CI_COMMIT_MESSAGE =~ /^release:\s\d/'
 
 
 package_publish:
@@ -164,6 +294,54 @@ package_publish:
     paths:
       #- skip.env
       - chart_version.txt
-  #rules:
-  #  - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    refs:
+      - main
+      - gitops-cd
+    variables:
+      - '$CI_COMMIT_MESSAGE =~ /^release:\s/'
+
+prepare_release:
+  stage: release
+  image: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/alpine:latest
+  dependencies:
+    - package_publish
+  script:
+    - RELEASE_VERSION=$(echo "$CI_COMMIT_MESSAGE" | sed -E 's/^release:[[:space:]]*//')
+    - echo "RELEASE_VERSION=$RELEASE_VERSION" > release.env
+    - cat release.env
+  artifacts:
+    reports:
+      dotenv: release.env
+  only:
+    refs:
+      - main
+      - develop
+    variables:
+      - '$CI_COMMIT_MESSAGE =~ /^release:\s/'
+
+
+release_job:
+  stage: release
+  image: labs.etsi.org:5050/osl/hypo/code/org.etsi.osl.hypo.ops/cicd/integration.tests/release-cli:latest
+  needs:
+    - job: package_publish
+    - job: prepare_release
+      artifacts: true
+  dependencies:
+    - prepare_release
+
+  script:
+    - echo "Creating release $RELEASE_VERSION"
+
+  release:
+    tag_name: $RELEASE_VERSION
+    description: $RELEASE_VERSION
+
+  only:
+    refs:
+      - main
+      - develop
+    variables:
+      - '$CI_COMMIT_MESSAGE =~ /^release:\s/'