diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1dc741efc5..fdc80df0b1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,9 +22,9 @@ jobs:
         run: |
           echo "${{ inputs.version_number }}" | grep -P '^v\d+\.\d+\.\d+(-pre[A-Za-z0-9-]*)?$'  
 
-    # QA acceptance tests are skipped when explicit input parameter is used
   run-qa-acceptance-tests:
     needs: [ validate-version-input ]
+    # Skipped when explicit input parameter is used
     if: needs.validate-version-input.result == 'success' && inputs.skip_tests != 'true'
     secrets: inherit
     uses: ./.github/workflows/acceptance-tests.yml
@@ -33,8 +33,10 @@ jobs:
       ref: ${{ inputs.use_existing_tag == 'true' && inputs.version_number  || github.ref }}
 
   update-changelog-header:
-    needs: [ run-qa-acceptance-tests ]
     runs-on: ubuntu-latest
+    needs: [ validate-version-input, run-qa-acceptance-tests ]
+    # Skipped if use_existing_tag is defined to true or previous jobs failed.
+    if: ${{ always() && inputs.use_existing_tag != 'true' && needs.validate-version-input.result == 'success' && (needs.run-qa-acceptance-tests.result == 'skipped' || needs.run-qa-acceptance-tests.result == 'success') }}
     steps:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
         with:
@@ -53,18 +55,23 @@ jobs:
   release:
     runs-on: ubuntu-latest
     needs: [ validate-version-input, run-qa-acceptance-tests, update-changelog-header ]
-    if: ${{ always() && needs.validate-version-input.result == 'success' && (needs.run-qa-acceptance-tests.result == 'skipped' || needs.run-qa-acceptance-tests.result == 'success') }}
+    # previous jobs must either be successful or skipped
+    if: ${{ always() && needs.validate-version-input.result == 'success' && (needs.run-qa-acceptance-tests.result == 'skipped' || needs.run-qa-acceptance-tests.result == 'success') && (needs.update-changelog-header.result == 'skipped' || needs.update-changelog-header.result == 'success') }}
     steps:
       - name: Checkout
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
         with:
-          ref: ${{ inputs.use_existing_tag == 'true' && inputs.version_number || github.ref }}
+          ref: ${{ inputs.use_existing_tag == 'true' && inputs.version_number || 'master' }}
       - name: Unshallow
         run: git fetch --prune --unshallow
+      - name: Get the latest commit SHA
+        id: get-sha
+        run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
       - name: Create release tag
         uses: rickstaa/action-create-tag@a1c7777fcb2fee4f19b0f283ba888afa11678b72
         with:
           tag: ${{ inputs.version_number }}
+          commit_sha: ${{ steps.get-sha.outputs.sha }}
           gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg_passphrase: ${{ secrets.PASSPHRASE }}
           tag_exists_error: ${{ inputs.use_existing_tag != 'true' }}
diff --git a/scripts/update-changelog-header-for-release.sh b/scripts/update-changelog-header-for-release.sh
index 36e31e1975..17ec6442b3 100755
--- a/scripts/update-changelog-header-for-release.sh
+++ b/scripts/update-changelog-header-for-release.sh
@@ -3,12 +3,12 @@ set -euo pipefail
 
 : "${1?"Tag of new release must be provided"}"
 
-CHANGELOG_FILE_PATH=CHANGELOG.md
+CHANGELOG_FILE_NAME=CHANGELOG.md
 RELEASE_TAG=$1
 RELEASE_NUMBER=$(echo "${RELEASE_TAG}" | tr -d v)
 
 # exit out if changelog already has the header updated with version number being released.
-if grep -q "## $RELEASE_NUMBER (" "$CHANGELOG_FILE_PATH"; then
+if grep -q "## $RELEASE_NUMBER (" "$CHANGELOG_FILE_NAME"; then
     echo "CHANGELOG already has a header defined for $RELEASE_NUMBER, no changes made to changelog."
     exit 0
 fi
@@ -17,9 +17,14 @@ fi
 TODAYS_DATE=$(date "+%B %d, %Y")  # Format the date as "Month day, Year"
 NEW_RELEASE_HEADER="## $RELEASE_NUMBER ($TODAYS_DATE)"
 
+
+
+CHANGELOG_TMP_FILE_NAME="CHANGELOG.tmp"
+rm -f $CHANGELOG_TMP_FILE_NAME
+
 # Insert the new version header after the "(Unreleased)" line
-sed -i "" -e "/(Unreleased)/a \\
+sed "/(Unreleased)/a \\
 \\
-$NEW_RELEASE_HEADER" $CHANGELOG_FILE_PATH
+$NEW_RELEASE_HEADER" $CHANGELOG_FILE_NAME > $CHANGELOG_TMP_FILE_NAME && mv $CHANGELOG_TMP_FILE_NAME $CHANGELOG_FILE_NAME
 
 echo "Changelog updated successfully defining header for new $RELEASE_TAG release."