diff --git a/Cargo.lock b/Cargo.lock
index 40a769f9c..9c0e6e980 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -236,7 +236,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "smallvec",
- "socket2 0.6.4",
+ "socket2 0.6.5",
  "time",
  "tracing",
  "url",
@@ -688,7 +688,7 @@ dependencies = [
  "http 0.2.12",
  "http 1.4.2",
  "http-body 0.4.6",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "percent-encoding",
  "pin-project-lite",
  "tracing",
@@ -722,7 +722,7 @@ dependencies = [
  "hmac 0.13.0",
  "http 0.2.12",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "lru",
  "percent-encoding",
  "regex-lite",
@@ -857,7 +857,7 @@ dependencies = [
  "crc-fast",
  "hex",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "md-5 0.11.0",
  "pin-project-lite",
@@ -891,7 +891,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "percent-encoding",
  "pin-project-lite",
@@ -920,7 +920,7 @@ dependencies = [
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
@@ -977,7 +977,7 @@ dependencies = [
  "http 0.2.12",
  "http 1.4.2",
  "http-body 0.4.6",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "pin-project-lite",
  "pin-utils",
@@ -1038,7 +1038,7 @@ dependencies = [
  "http 0.2.12",
  "http 1.4.2",
  "http-body 0.4.6",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "itoa",
  "num-integer",
@@ -1918,7 +1918,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e75b2483e97a5a7da73ac68a05b629f9c53cff58d8ed1c77866079e18b00dba5"
 dependencies = [
  "digest 0.10.7",
- "spin 0.10.0",
+ "spin 0.10.1",
 ]
 
 [[package]]
@@ -2798,7 +2798,7 @@ checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
 dependencies = [
  "futures-core",
  "futures-sink",
- "spin 0.9.8",
+ "spin 0.9.9",
 ]
 
 [[package]]
@@ -3458,9 +3458,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
  "http 1.4.2",
@@ -3468,14 +3468,14 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "pin-project-lite",
 ]
 
@@ -3574,7 +3574,7 @@ dependencies = [
  "futures-core",
  "h2 0.4.15",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "httparse",
  "httpdate",
  "itoa",
@@ -3608,7 +3608,7 @@ dependencies = [
  "http 1.4.2",
  "hyper 1.10.1",
  "hyper-util",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-native-certs",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -3656,13 +3656,13 @@ dependencies = [
  "futures-channel",
  "futures-util",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "hyper 1.10.1",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.4",
+ "socket2 0.6.5",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -3905,7 +3905,7 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2 0.6.4",
+ "socket2 0.6.5",
  "widestring",
  "windows-registry",
  "windows-result 0.4.1",
@@ -4196,7 +4196,7 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
- "spin 0.9.8",
+ "spin 0.9.9",
 ]
 
 [[package]]
@@ -4592,9 +4592,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "log",
@@ -5874,8 +5874,8 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls 0.23.41",
- "socket2 0.6.4",
+ "rustls 0.23.42",
+ "socket2 0.6.5",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5896,7 +5896,7 @@ dependencies = [
  "rand_pcg",
  "ring",
  "rustc-hash",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.18",
@@ -5914,7 +5914,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.4",
+ "socket2 0.6.5",
  "tracing",
  "windows-sys 0.61.2",
 ]
@@ -6158,7 +6158,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "hyper 1.10.1",
  "hyper-rustls 0.27.9",
@@ -6168,7 +6168,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -6200,7 +6200,7 @@ dependencies = [
  "futures-util",
  "h2 0.4.15",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "hyper 1.10.1",
  "hyper-rustls 0.27.9",
@@ -6213,7 +6213,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
@@ -6536,9 +6536,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
 dependencies = [
  "aws-lc-rs",
  "once_cell",
@@ -6582,7 +6582,7 @@ dependencies = [
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
@@ -7360,9 +7360,9 @@ checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
 [[package]]
 name = "simd_cesu8"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
 dependencies = [
  "rustc_version",
  "simdutf8",
@@ -7417,9 +7417,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -7463,18 +7463,18 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.9.8"
+version = "0.9.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
 dependencies = [
  "lock_api",
 ]
 
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
 [[package]]
 name = "spki"
@@ -7537,7 +7537,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "rust_decimal",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -7575,7 +7575,7 @@ dependencies = [
  "log",
  "memchr",
  "percent-encoding",
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -8283,7 +8283,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.4",
+ "socket2 0.6.5",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -8336,7 +8336,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.41",
+ "rustls 0.23.42",
  "tokio",
 ]
 
@@ -8408,7 +8408,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "http-body-util",
  "hyper 1.10.1",
  "hyper-timeout",
@@ -8475,7 +8475,7 @@ dependencies = [
  "bytes",
  "futures-util",
  "http 1.4.2",
- "http-body 1.0.1",
+ "http-body 1.1.0",
  "pin-project-lite",
  "tower",
  "tower-layer",
@@ -8598,7 +8598,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-auth"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -8631,7 +8631,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-cli"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -8650,7 +8650,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-common"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-web",
  "anyhow",
@@ -8707,7 +8707,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-db"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -8724,7 +8724,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-entity"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "cpe",
@@ -8751,7 +8751,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-infrastructure"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-cors",
  "actix-tls",
@@ -8786,7 +8786,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-migration"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -8821,7 +8821,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-analysis"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -8870,7 +8870,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-fundamental"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -8947,7 +8947,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-importer"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -9002,7 +9002,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-ingestor"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -9056,7 +9056,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-storage"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "async-compression",
@@ -9088,7 +9088,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-ui"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-web",
  "actix-web-static-files",
@@ -9110,7 +9110,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-module-user"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -9132,14 +9132,14 @@ dependencies = [
 
 [[package]]
 name = "trustify-query"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "utoipa",
 ]
 
 [[package]]
 name = "trustify-query-derive"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "quote",
  "syn 2.0.118",
@@ -9147,7 +9147,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-server"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-web",
  "anyhow",
@@ -9185,7 +9185,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-test-context"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "actix-http",
  "actix-web",
@@ -9235,7 +9235,7 @@ dependencies = [
 
 [[package]]
 name = "trustify-trustd"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "clap",
@@ -10099,9 +10099,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 dependencies = [
  "memchr",
 ]
@@ -10168,7 +10168,7 @@ checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
 
 [[package]]
 name = "xtask"
-version = "0.5.0-rc.4"
+version = "0.5.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -10377,9 +10377,9 @@ checksum = "b142a20ec14a91d5bc708c1dc21b080c550113d8aa77afa29635673a65dd02c5"
 
 [[package]]
 name = "zmij"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd2f034a4bebf216c9e4b7083603e024cf930873fd67830cfb083c9fa33129d9"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zopfli"
diff --git a/Cargo.toml b/Cargo.toml
index 50882c10c..68b0de897 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,7 +24,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.0-rc.4"
+version = "0.5.0"
 edition = "2024"
 publish = false
 license = "Apache-2.0"
diff --git a/openapi.yaml b/openapi.yaml
index 9b6639c7c..e1171cc10 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -5,7 +5,7 @@ info:
   license:
     name: Apache License, Version 2.0
     identifier: Apache-2.0
-  version: 0.5.0-rc.4
+  version: 0.5.0
 paths:
   /.well-known/trustify:
     get:
diff --git a/test-context/src/migration.rs b/test-context/src/migration.rs
index fe69a3f7d..733425536 100644
--- a/test-context/src/migration.rs
+++ b/test-context/src/migration.rs
@@ -5,7 +5,12 @@ use git2::{BranchType, Repository};
 use indicatif::{ProgressBar, ProgressStyle};
 use reqwest::StatusCode;
 use sha2::Digest;
-use std::{env, fs::File, path::Path, path::PathBuf};
+use std::{
+    collections::HashSet,
+    env,
+    fs::File,
+    path::{Path, PathBuf},
+};
 use tokio::{
     fs,
     io::{self, AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader},
@@ -106,39 +111,58 @@ fn current_branch(path: impl AsRef<Path>) -> anyhow::Result<String> {
         }
     }
 
-    // Collect candidate parent branches: local branches named `main` or starting with `release/`.
+    // GitHub Actions sets GITHUB_BASE_REF to the PR target branch (e.g. "release/0.5.z")
+    if let Ok(base_ref) = env::var("GITHUB_BASE_REF")
+        && is_relevant(&base_ref)
+    {
+        log::info!("Using GITHUB_BASE_REF: {base_ref}");
+        return Ok(base_ref);
+    }
 
+    // Collect candidate parent branches named `main` or starting with `release/`.
+    // Include remote-tracking branches so that e.g. `origin/release/0.5.z` is found
+    // even when the branch is not checked out locally (common in CI shallow clones).
+
+    let mut seen = HashSet::new();
     let mut candidates = Vec::new();
-    for branch_res in repo.branches(Some(BranchType::Local))? {
-        let (branch, _branch_type) = branch_res?;
-        let Some(name) = branch.name()? else {
-            continue;
+    for branch_res in repo.branches(None)? {
+        let (branch, branch_type) = branch_res?;
+        let raw_name = match branch.name()? {
+            Some(n) => n.to_string(),
+            None => continue,
         };
 
-        if is_relevant(name) {
-            candidates.push(branch);
+        // Strip remote prefix (e.g. "origin/release/0.5.z" → "release/0.5.z")
+        let name = if branch_type == BranchType::Remote {
+            raw_name
+                .split_once('/')
+                .map(|(_, rest)| rest.to_string())
+                .unwrap_or(raw_name)
+        } else {
+            raw_name
+        };
+
+        if is_relevant(&name) && seen.insert(name.clone()) {
+            candidates.push((branch, name));
         }
     }
 
     // Try to find if HEAD matches any branch tip exactly
 
-    for candidate in &candidates {
-        let Ok(commit) = candidate.get().peel_to_commit() else {
+    for (branch, name) in &candidates {
+        let Ok(commit) = branch.get().peel_to_commit() else {
             continue;
         };
 
         if commit.id() == head_commit.id() {
-            return Ok(candidate.name()?.unwrap_or("unknown").to_string());
+            return Ok(name.clone());
         }
     }
 
     if log::log_enabled!(log::Level::Info) {
         log::info!(
             "Candidate: {:?}",
-            candidates
-                .iter()
-                .map(|b| format!("{:?}", b.name()))
-                .collect::<Vec<_>>()
+            candidates.iter().map(|(_, n)| n).collect::<Vec<_>>()
         );
     }
 
@@ -147,8 +171,8 @@ fn current_branch(path: impl AsRef<Path>) -> anyhow::Result<String> {
     let mut best_branch: Option<String> = None;
     let mut best_time: i64 = i64::MIN;
 
-    for candidate in candidates {
-        let Ok(candidate_commit) = candidate.get().peel_to_commit() else {
+    for (branch, name) in &candidates {
+        let Ok(candidate_commit) = branch.get().peel_to_commit() else {
             continue;
         };
 
@@ -163,7 +187,7 @@ fn current_branch(path: impl AsRef<Path>) -> anyhow::Result<String> {
         let t = ancestor_commit.time().seconds();
         if t > best_time {
             best_time = t;
-            best_branch = candidate.name().ok().flatten().map(String::from);
+            best_branch = Some(name.clone());
             log::info!("New best branch: {best_branch:?}");
         }
     }