diff --git a/.github/workflows/generate-changelog.yml b/.github/workflows/generate-changelog.yml
index 28207ab6ba..99fbed2678 100644
--- a/.github/workflows/generate-changelog.yml
+++ b/.github/workflows/generate-changelog.yml
@@ -116,10 +116,11 @@ jobs:
           CHANGELOG="${CHANGELOG}**Release Type**: ${RELEASE_TYPE}\n"
           CHANGELOG="${CHANGELOG}**Full Changelog**: https://github.com/${{ github.repository }}/compare/${LATEST_TAG:-initial}...v${VERSION}\n"
 
-          # Escape for multiline output (use unique delimiter to avoid collision with commit messages)
-          echo "changelog<<__CHANGELOG_HEREDOC_DELIMITER__" >> $GITHUB_OUTPUT
+          # Escape for multiline output (random delimiter prevents collision with commit messages)
+          DELIMITER="CHANGELOG_$(openssl rand -hex 16)"
+          echo "changelog<<${DELIMITER}" >> $GITHUB_OUTPUT
           echo -e "$CHANGELOG" >> $GITHUB_OUTPUT
-          echo "__CHANGELOG_HEREDOC_DELIMITER__" >> $GITHUB_OUTPUT
+          echo "${DELIMITER}" >> $GITHUB_OUTPUT
           echo "changelog_file=CHANGELOG.md" >> $GITHUB_OUTPUT
 
           # Also write to step summary
diff --git a/.github/workflows/promote-branch.yml b/.github/workflows/promote-branch.yml
index bcf99ffd87..ab2afd6dfa 100644
--- a/.github/workflows/promote-branch.yml
+++ b/.github/workflows/promote-branch.yml
@@ -163,9 +163,10 @@ jobs:
           fi
 
           echo "count=$COMMIT_COUNT" >> $GITHUB_OUTPUT
-          echo "summary<<__COMMITS_DELIM__" >> $GITHUB_OUTPUT
+          DELIM="COMMITS_$(openssl rand -hex 16)"
+          echo "summary<<${DELIM}" >> $GITHUB_OUTPUT
           echo "$COMMIT_SUMMARY" >> $GITHUB_OUTPUT
-          echo "__COMMITS_DELIM__" >> $GITHUB_OUTPUT
+          echo "${DELIM}" >> $GITHUB_OUTPUT
 
       - name: Check for existing PR
         id: check-pr
diff --git a/.github/workflows/release-orchestrator.yml b/.github/workflows/release-orchestrator.yml
index 7289ff3ca7..25188b3c3f 100644
--- a/.github/workflows/release-orchestrator.yml
+++ b/.github/workflows/release-orchestrator.yml
@@ -133,9 +133,10 @@ jobs:
             echo "commits=" >> $GITHUB_OUTPUT
           else
             echo "has_changes=true" >> $GITHUB_OUTPUT
-            echo "commits<<__COMMITS_DELIM__" >> $GITHUB_OUTPUT
+            DELIM="COMMITS_$(openssl rand -hex 16)"
+            echo "commits<<${DELIM}" >> $GITHUB_OUTPUT
             echo "$COMMITS" >> $GITHUB_OUTPUT
-            echo "__COMMITS_DELIM__" >> $GITHUB_OUTPUT
+            echo "${DELIM}" >> $GITHUB_OUTPUT
           fi
 
   # Version operations
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c63a64b229..c74363c2e4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,6 +25,9 @@ Welcome to the lobster tank! 🦞
 - **Gustavo Madeira Santana** - Multi-agents, CLI, web UI
   - GitHub: [@gumadeiras](https://github.com/gumadeiras) · X: [@gumadeiras](https://x.com/gumadeiras)
 
+- **Maximilian Nussbaumer** - DevOps, CI/CD
+  - GitHub: [@quotentiroler](https://github.com/quotentiroler)
+
 ## How to Contribute
 
 1. **Bugs & small fixes** → Open a PR!
@@ -81,12 +84,12 @@ Check the [GitHub Issues](https://github.com/openclaw/openclaw/issues) for "good
 
 Not everything belongs in the main repo. Here's how to decide:
 
-| Belongs in **Core** | Belongs on **[ClawHub](https://clawhub.ai)** |
-|---|---|
+| Belongs in **Core**                            | Belongs on **[ClawHub](https://clawhub.ai)**         |
+| ---------------------------------------------- | ---------------------------------------------------- |
 | Channel integrations (Telegram, Discord, etc.) | Domain-specific skills (QR codes, image tools, etc.) |
-| CLI commands and infrastructure | Custom workflows and automations |
-| Provider integrations (LLM backends) | Niche or experimental utilities |
-| Security, routing, and core plumbing | Third-party service integrations |
+| CLI commands and infrastructure                | Custom workflows and automations                     |
+| Provider integrations (LLM backends)           | Niche or experimental utilities                      |
+| Security, routing, and core plumbing           | Third-party service integrations                     |
 
 **Rule of thumb:** if it adds new dependencies or is useful to some users but not most, it belongs on ClawHub. When in doubt, ask in Discord or open a Discussion before writing code.
 
diff --git a/docs/reference/pipeline.md b/docs/reference/pipeline.md
index ca862b3824..f8936b24b2 100644
--- a/docs/reference/pipeline.md
+++ b/docs/reference/pipeline.md
@@ -114,11 +114,11 @@ docker pull ghcr.io/openclaw/openclaw:2026.2.6
 
 Configure these in GitHub repo Settings → Secrets and variables → Actions:
 
-| Secret | Required? | Purpose | How to get it |
-|--------|-----------|---------|---------------|
-| `GITHUB_TOKEN` | Automatic | PR creation, Docker registry, branch ops | Provided by GitHub Actions — no setup needed |
-| `NPM_TOKEN` | Yes (for publishing) | npm publish with `@alpha`, `@beta`, `@latest` tags | npmjs.com → Access Tokens → Generate New Token → Automation |
-| `DISCORD_WEBHOOK_URL` | Optional | Notifications for promotions, test results, deployments | Discord → Server Settings → Integrations → Webhooks |
+| Secret                | Required?            | Purpose                                                 | How to get it                                               |
+| --------------------- | -------------------- | ------------------------------------------------------- | ----------------------------------------------------------- |
+| `GITHUB_TOKEN`        | Automatic            | PR creation, Docker registry, branch ops                | Provided by GitHub Actions — no setup needed                |
+| `NPM_TOKEN`           | Yes (for publishing) | npm publish with `@alpha`, `@beta`, `@latest` tags      | npmjs.com → Access Tokens → Generate New Token → Automation |
+| `DISCORD_WEBHOOK_URL` | Optional             | Notifications for promotions, test results, deployments | Discord → Server Settings → Integrations → Webhooks         |
 
 Without `NPM_TOKEN`, the pipeline runs normally but skips npm publishing. Without `DISCORD_WEBHOOK_URL`, notifications are silently skipped.