diff --git a/.gitea/workflows/build_device_agent.yaml b/.gitea/workflows/build_device_agent.yaml
index 5c28562..4b3d614 100644
--- a/.gitea/workflows/build_device_agent.yaml
+++ b/.gitea/workflows/build_device_agent.yaml
@@ -24,6 +24,12 @@ jobs:
           go-version: '1.26'
           cache: true
 
+      - name: Generate Windows resources (UAC manifest + icon)
+        working-directory: apps/device-agent
+        run: |
+          go install github.com/tc-hib/go-winres@latest
+          go-winres make
+
       - name: Build all platforms
         working-directory: apps/device-agent
         shell: bash
diff --git a/.gitea/workflows/build_server_core.yaml b/.gitea/workflows/build_server_core.yaml
index afc4e3a..aa150b1 100644
--- a/.gitea/workflows/build_server_core.yaml
+++ b/.gitea/workflows/build_server_core.yaml
@@ -24,12 +24,6 @@ jobs:
           go-version: '1.26'
           cache: true
 
-      - name: Generate Swagger docs
-        working-directory: apps/server-core
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@v1.16.6
-          swag init -g main.go --parseDependency --parseInternal
-
       - name: Build
         working-directory: apps/server-core
         run: go build -o bin/server-core .
diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index c45e064..29961fe 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -10,9 +10,11 @@ on:
       - 'v[0-9]*.[0-9]*.[0-9]'
 
 jobs:
-  # --- TESTS (test tags + stable release tags) ---
+  # ====================================================================
+  # TEST TAGS — test only, no build, no docs
+  # ====================================================================
   server-core-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -26,17 +28,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
-      - name: Generate swagger docs
-        working-directory: apps/server-core
-        run: |
-          go install github.com/swaggo/swag/cmd/swag@v1.16.6
-          swag init -g main.go --parseDependency --parseInternal
+          cache: true
       - name: Test (skip nftables - needs root)
         working-directory: apps/server-core
         run: go test $(go list ./... | grep -v internal/firewall) -tags dev -cover -count=1
 
   device-agent-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -50,12 +48,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
+          cache: true
       - name: Test
         working-directory: apps/device-agent
         run: go test ./... -cover
 
   dashboard-test:
-    if: contains(gitea.ref_name, 'test') || (!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta'))
+    if: contains(gitea.ref_name, 'test')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -76,40 +75,68 @@ jobs:
         working-directory: apps/dashboard-ui
         run: npm run build
 
-  # --- BUILD + RELEASE (dev/beta/release tags) ---
-  build-server-core:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
-    needs: [server-core-test, device-agent-test, dashboard-test]
+  # ====================================================================
+  # DEV/BETA TAGS — build only, no docs, no test
+  # ====================================================================
+  build-server-core-dev:
+    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_server_core.yaml
     secrets: inherit
 
-  build-device-agent:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
-    needs: [server-core-test, device-agent-test, dashboard-test]
+  build-device-agent-dev:
+    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_device_agent.yaml
     secrets: inherit
 
-  build-dashboard:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
-    needs: [server-core-test, device-agent-test, dashboard-test]
+  build-dashboard-dev:
+    if: contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')
     runs-on: ubuntu-latest
     uses: ./.gitea/workflows/build_dashboard.yaml
     secrets: inherit
 
-  build-docs:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
-    needs: [server-core-test, device-agent-test, dashboard-test]
-    runs-on: ubuntu-latest
-    uses: ./.gitea/workflows/docs_call.yaml
-    secrets: inherit
-
-  release:
-    if: always() && !contains(gitea.ref_name, 'test') && !failure()
-    needs: [build-server-core, build-device-agent, build-dashboard, build-docs]
+  release-dev:
+    if: (contains(gitea.ref_name, 'dev') || contains(gitea.ref_name, 'beta')) && !failure()
+    needs: [build-server-core-dev, build-device-agent-dev, build-dashboard-dev]
     uses: ./.gitea/workflows/release_call.yaml
     with:
       prerelease: ${{ contains(gitea.ref_name, 'dev') }}
       draft: ${{ contains(gitea.ref_name, 'beta') }}
     secrets: inherit
+
+  # ====================================================================
+  # RELEASE TAGS — build all + docs + release
+  # ====================================================================
+  build-server-core-release:
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
+    runs-on: ubuntu-latest
+    uses: ./.gitea/workflows/build_server_core.yaml
+    secrets: inherit
+
+  build-device-agent-release:
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
+    runs-on: ubuntu-latest
+    uses: ./.gitea/workflows/build_device_agent.yaml
+    secrets: inherit
+
+  build-dashboard-release:
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
+    runs-on: ubuntu-latest
+    uses: ./.gitea/workflows/build_dashboard.yaml
+    secrets: inherit
+
+  build-docs-release:
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test')"
+    runs-on: ubuntu-latest
+    uses: ./.gitea/workflows/docs_call.yaml
+    secrets: inherit
+
+  release-stable:
+    if: "!contains(gitea.ref_name, 'dev') && !contains(gitea.ref_name, 'beta') && !contains(gitea.ref_name, 'test') && !failure()
+    needs: [build-server-core-release, build-device-agent-release, build-dashboard-release, build-docs-release]
+    uses: ./.gitea/workflows/release_call.yaml
+    with:
+      prerelease: false
+      draft: false
+    secrets: inherit
diff --git a/.gitea/workflows/docs_call.yaml b/.gitea/workflows/docs_call.yaml
index 7f74c7d..f3df2ef 100644
--- a/.gitea/workflows/docs_call.yaml
+++ b/.gitea/workflows/docs_call.yaml
@@ -21,6 +21,17 @@ jobs:
         with:
           node-version: '24'
 
+      - name: Hash package-lock
+        id: hash-npm
+        run: echo "hash=$(sha256sum apps/docs/package-lock.json 2>/dev/null || echo 'none') | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.npm
+          key: npm-docs-${{ steps.hash-npm.outputs.hash }}
+          restore-keys: npm-docs-
+
       - name: Install
         working-directory: apps/docs
         run: npm ci || npm install