diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml
index 25dcfc677..49efcb896 100644
--- a/.github/workflows/docker-build-check.yml
+++ b/.github/workflows/docker-build-check.yml
@@ -6,9 +6,9 @@ name: Docker Build Check
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
 
 env:
   DSTACK_REV: ${{ github.event.pull_request.head.sha || github.sha }}
diff --git a/.github/workflows/gateway-proxy-tests.yml b/.github/workflows/gateway-proxy-tests.yml
index 9a91d8031..48b56e528 100644
--- a/.github/workflows/gateway-proxy-tests.yml
+++ b/.github/workflows/gateway-proxy-tests.yml
@@ -10,13 +10,13 @@ name: Gateway proxy tests
 # and asserts on what actually reaches the wire.
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/vendor/ktls/**'
       - '.github/workflows/gateway-proxy-tests.yml'
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
     paths:
       - 'dstack/gateway/**'
       - 'dstack/vendor/ktls/**'
diff --git a/.github/workflows/mkosi-build.yml b/.github/workflows/mkosi-build.yml
index 02e7978ce..29ed2b074 100644
--- a/.github/workflows/mkosi-build.yml
+++ b/.github/workflows/mkosi-build.yml
@@ -25,7 +25,7 @@ on:
   # would be silently dropped. The static job costs seconds and the image build
   # is gated by its own `if`, so an unfiltered push trigger is cheap.
   push:
-    branches: [master, next]
+    branches: [next, 'release/**']
     tags: ['mkosi-os-v*']
 
 concurrency:
diff --git a/.github/workflows/prek-check.yml b/.github/workflows/prek-check.yml
index 2524e6802..41454bd16 100644
--- a/.github/workflows/prek-check.yml
+++ b/.github/workflows/prek-check.yml
@@ -6,9 +6,9 @@ name: Prek checks
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
 
 permissions:
   contents: read
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index a269d4c49..f028ea67e 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -6,9 +6,9 @@ name: Rust checks
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/sdk.yaml b/.github/workflows/sdk.yaml
index 32a824e17..906192202 100644
--- a/.github/workflows/sdk.yaml
+++ b/.github/workflows/sdk.yaml
@@ -9,9 +9,9 @@ permissions:
 
 on:
   push:
-    branches: [master, next, dev-*]
+    branches: [next, 'release/**']
   pull_request:
-    branches: [master, next, dev-*]
+    branches: [next, 'release/**']
 
 env:
   CARGO_TERM_COLOR: always
diff --git a/.github/workflows/spdx-check.yml b/.github/workflows/spdx-check.yml
index e2328315f..dc24dfd08 100644
--- a/.github/workflows/spdx-check.yml
+++ b/.github/workflows/spdx-check.yml
@@ -6,9 +6,9 @@ name: SPDX License Check
 
 on:
   push:
-    branches: [ master, next ]
+    branches: [ next, 'release/**' ]
   pull_request:
-    branches: [ master, next ]
+    branches: [ next, 'release/**' ]
 
 jobs:
   reuse-lint:
diff --git a/.github/workflows/vmm-ui.yml b/.github/workflows/vmm-ui.yml
index ea571b4ce..2abda43db 100644
--- a/.github/workflows/vmm-ui.yml
+++ b/.github/workflows/vmm-ui.yml
@@ -9,9 +9,9 @@ permissions:
 
 on:
   push:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
   pull_request:
-    branches: [ master, next, dev-* ]
+    branches: [ next, 'release/**' ]
 
 jobs:
   build:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 196b838a5..c6cf272d4 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,29 @@
 
 Thank you for your interest in contributing to this project!
 
+## Branches
+
+- `next` is the integration mainline and the default branch. Open every pull
+  request against it unless a maintainer asks otherwise.
+- `release/v<major>.<minor>.x` carries a released line — `release/v0.5.x` is
+  the current one. It only takes fixes cherry-picked back from `next`; do not
+  develop on it directly. Patch tags are cut here.
+
+Name a working branch whatever describes it. CI runs on pull requests, so a
+branch gets its checks once a PR is open rather than on every push.
+
+The default branch was renamed from `master` to `next`. Web links, raw file
+URLs, and the REST API redirect, but the old ref name is gone at the git
+level: `git fetch origin master` and `git clone -b master` now fail. Update an
+existing clone with:
+
+```bash
+git branch -m master next
+git fetch origin
+git branch -u origin/next next
+git remote set-head origin -a
+```
+
 ## Development
 
 1. Fork the repository
diff --git a/README.md b/README.md
index c35194b7e..0419cb498 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 ### The open framework for confidential AI.
 
 [![GitHub Stars](https://img.shields.io/github/stars/dstack-tee/dstack?style=flat-square&logo=github)](https://github.com/Dstack-TEE/dstack/stargazers)
-[![License](https://img.shields.io/github/license/dstack-tee/dstack?style=flat-square)](https://github.com/Dstack-TEE/dstack/blob/master/LICENSE)
+[![License](https://img.shields.io/github/license/dstack-tee/dstack?style=flat-square)](https://github.com/Dstack-TEE/dstack/blob/next/LICENSE)
 [![REUSE status](https://api.reuse.software/badge/github.com/Dstack-TEE/dstack)](https://api.reuse.software/info/github.com/Dstack-TEE/dstack)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/Dstack-TEE/dstack)
 [![Telegram](https://img.shields.io/badge/Telegram-2CA5E0?style=flat-square&logo=telegram&logoColor=white)](https://t.me/+UO4bS4jflr45YmUx)
@@ -221,7 +221,7 @@ Yes. dstack runs on supported TEE-capable servers, including Intel TDX-capable h
 <details>
 <summary><strong>How do users verify my deployment?</strong></summary>
 
-Your app exposes attestation quotes via the SDK. Users verify these quotes using [dstack-verifier](https://github.com/Dstack-TEE/dstack/tree/master/dstack/verifier), [dcap-qvl](https://github.com/Phala-Network/dcap-qvl), or the [Trust Center](https://trust.phala.com). See the [verification guide](./docs/verification.md) for details.
+Your app exposes attestation quotes via the SDK. Users verify these quotes using [dstack-verifier](https://github.com/Dstack-TEE/dstack/tree/next/dstack/verifier), [dcap-qvl](https://github.com/Phala-Network/dcap-qvl), or the [Trust Center](https://trust.phala.com). See the [verification guide](./docs/verification.md) for details.
 
 </details>
 
diff --git a/docs/attestation-tdx.md b/docs/attestation-tdx.md
index 85674c6e7..a71533ef1 100644
--- a/docs/attestation-tdx.md
+++ b/docs/attestation-tdx.md
@@ -83,7 +83,7 @@ To verify dstack App data trustworthiness:
 
 - Review source code for correctness and safety.
 - Build image from source.
-- Calculate MRTD, RTMR0, RTMR1, and RTMR2 values using [dstack-mr](https://github.com/Dstack-TEE/dstack/tree/master/dstack/dstack-mr).
+- Calculate MRTD, RTMR0, RTMR1, and RTMR2 values using [dstack-mr](https://github.com/Dstack-TEE/dstack/tree/next/dstack/dstack-mr).
 - Verify quote measurements:
     - Confirm MRTD, RTMR0, RTMR1, and RTMR2 match pre-calculated values.
     - Verify RTMR3 matches the event log replay result.
diff --git a/docs/onboarding.md b/docs/onboarding.md
index e36d89f71..0d4488bab 100644
--- a/docs/onboarding.md
+++ b/docs/onboarding.md
@@ -3,7 +3,7 @@
 Use this guide to get a first dstack app running on one Intel TDX host. The workflow uses `dstackup` for host setup and `dstack` for app deployment:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/master/dstack/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/next/dstack/scripts/install.sh | sh
 sudo dstackup install
 sudo dstack deploy \
   -n hello-nginx \
@@ -78,7 +78,7 @@ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 Build and install the `dstackup` bootstrap command:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/master/dstack/scripts/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/next/dstack/scripts/install.sh | sh
 ```
 
 The bootstrap installer builds `dstackup` from a temporary source checkout and installs it under `/usr/local/bin`. The `dstackup install` command then builds and installs `dstack`, `dstack-auth`, `dstack-vmm`, `supervisor`, static assets, and host config into the system layout.
@@ -216,7 +216,7 @@ Use `--prefix` when you want a second isolated install on the same host. A custo
 Install `dstackup` into the prefix, then use the same prefix for `dstackup` and `dstack`:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/master/dstack/scripts/install.sh | sh -s -- --prefix /opt/dstack-test
+curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/next/dstack/scripts/install.sh | sh -s -- --prefix /opt/dstack-test
 
 sudo /opt/dstack-test/bin/dstackup install \
   --prefix /opt/dstack-test \
diff --git a/docs/tutorials/clone-build-dstack-vmm.md b/docs/tutorials/clone-build-dstack-vmm.md
index 33cc09af0..21bd7b08f 100644
--- a/docs/tutorials/clone-build-dstack-vmm.md
+++ b/docs/tutorials/clone-build-dstack-vmm.md
@@ -56,13 +56,13 @@ All build commands should be run as the `ubuntu` user. Only the final installati
 ### Step 2: Verify dstack Repository
 
 The dstack repository should already be cloned and checked out on the current
-`master` branch from [Local Key Provider](/tutorial/gramine-key-provider):
+`next` branch from [Local Key Provider](/tutorial/gramine-key-provider):
 
 ```bash
 cd ~/dstack
 git describe --tags
 git branch --show-current
-# Should show master
+# Should show next
 ```
 
 ### Step 3: Build dstack-vmm
@@ -111,8 +111,8 @@ ls -la /usr/local/bin/dstack-supervisor
 # Check out a monorepo-era release tag when one is available
 git checkout <release-tag>
 
-# Or use the master branch for latest development
-git checkout master
+# Or use the next branch for latest development
+git checkout next
 git pull --ff-only
 ```
 
diff --git a/docs/tutorials/contract-deployment.md b/docs/tutorials/contract-deployment.md
index e01085edb..b5e429871 100644
--- a/docs/tutorials/contract-deployment.md
+++ b/docs/tutorials/contract-deployment.md
@@ -49,12 +49,12 @@ These contracts use the UUPS (Universal Upgradeable Proxy Standard) pattern for
 
 ### Step 1: Clone Repository and Navigate to auth-eth
 
-On your **local machine**, clone the dstack repository (if you haven't already) and use the current `master` branch:
+On your **local machine**, clone the dstack repository (if you haven't already) and use the current `next` branch:
 
 ```bash
 git clone https://github.com/Dstack-TEE/dstack.git ~/dstack 2>/dev/null || true
 cd ~/dstack
-git checkout master
+git checkout next
 cd dstack/kms/auth-eth
 ```
 
diff --git a/docs/verification.md b/docs/verification.md
index 1f54857a4..7b49fe36f 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -18,7 +18,7 @@ If any of these fail, the cryptographic proof won't verify.
 
 **Programmatic verification**: dstack provides several tools:
 
-- [dstack-verifier](https://github.com/Dstack-TEE/dstack/tree/master/dstack/verifier) - HTTP service with `/verify` endpoint, also runs as CLI
+- [dstack-verifier](https://github.com/Dstack-TEE/dstack/tree/next/dstack/verifier) - HTTP service with `/verify` endpoint, also runs as CLI
 - [dcap-qvl](https://github.com/Phala-Network/dcap-qvl) - Open source quote verification library (Rust, Python, JS/WASM, CLI)
 - [SDKs](../sdk/) - JavaScript and Python SDKs include `replayRtmrs()` for local RTMR verification
 
diff --git a/dstack/crates/dstackup/src/cli.rs b/dstack/crates/dstackup/src/cli.rs
index 4022aada7..cfcfbd927 100644
--- a/dstack/crates/dstackup/src/cli.rs
+++ b/dstack/crates/dstackup/src/cli.rs
@@ -11,7 +11,7 @@ pub(crate) const DEFAULT_VMM_BIN: &str = "dstack-vmm";
 pub(crate) const DEFAULT_AUTH_BIN: &str = "dstack-auth";
 pub(crate) const DEFAULT_SUPERVISOR_BIN: &str = "supervisor";
 pub(crate) const DEFAULT_SOURCE_REPO: &str = "https://github.com/Dstack-TEE/dstack";
-pub(crate) const DEFAULT_SOURCE_REF: &str = "master";
+pub(crate) const DEFAULT_SOURCE_REF: &str = "next";
 pub(crate) const DEFAULT_RELEASE_API_BASE_URL: &str = "https://api.github.com/repos";
 
 #[derive(Parser)]
diff --git a/dstack/kms/auth-mock/Dockerfile b/dstack/kms/auth-mock/Dockerfile
index 3bb12a25d..75207418a 100644
--- a/dstack/kms/auth-mock/Dockerfile
+++ b/dstack/kms/auth-mock/Dockerfile
@@ -6,7 +6,7 @@ FROM oven/bun:1-alpine
 WORKDIR /app
 
 ARG DSTACK_REV
-ARG DSTACK_BRANCH=master
+ARG DSTACK_BRANCH=next
 
 RUN apk add --no-cache git
 RUN git clone --branch ${DSTACK_BRANCH} https://github.com/Dstack-TEE/dstack.git && \
diff --git a/dstack/scripts/install.sh b/dstack/scripts/install.sh
index af245443a..6ba7b6fb8 100755
--- a/dstack/scripts/install.sh
+++ b/dstack/scripts/install.sh
@@ -6,7 +6,7 @@
 set -eu
 
 DEFAULT_REPO="https://github.com/Dstack-TEE/dstack"
-DEFAULT_REF="master"
+DEFAULT_REF="next"
 DEFAULT_PREFIX="/usr/local"
 
 usage() {
@@ -15,13 +15,13 @@ Install dstackup from source.
 
 Usage:
   dstack/scripts/install.sh [options]
-  curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/master/dstack/scripts/install.sh | sh
+  curl -fsSL https://raw.githubusercontent.com/Dstack-TEE/dstack/next/dstack/scripts/install.sh | sh
 
 Options:
   --repo URL       Git repository to clone when not run from a checkout.
                   Default: https://github.com/Dstack-TEE/dstack
   --ref REF        Git ref to checkout when cloning or updating DSTACK_SRC.
-                  Default: master
+                  Default: next
   --src DIR        Persistent source checkout to build from.
                   Default: a temporary checkout
   --prefix DIR     Install dstackup under DIR/bin. Use the same DIR with
diff --git a/dstack/verifier/README.md b/dstack/verifier/README.md
index 58272d7af..ce229a53f 100644
--- a/dstack/verifier/README.md
+++ b/dstack/verifier/README.md
@@ -6,7 +6,7 @@ A HTTP server that provides dstack quote verification services using the same ve
 
 ### POST /verify
 
-Verifies a dstack attestation or quote with the provided data and VM configuration. The body can be grabbed via [getQuote](https://github.com/Dstack-TEE/dstack/blob/master/sdk/curl/api.md#3-get-quote) or [attest](https://github.com/Dstack-TEE/dstack/blob/master/sdk/curl/api.md#8-attest).
+Verifies a dstack attestation or quote with the provided data and VM configuration. The body can be grabbed via [getQuote](https://github.com/Dstack-TEE/dstack/blob/next/sdk/curl/api.md#3-get-quote) or [attest](https://github.com/Dstack-TEE/dstack/blob/next/sdk/curl/api.md#8-attest).
 
 **Request Body:**
 Provide either `attestation` or (`quote` + `event_log` + `vm_config`).
diff --git a/os/spec/artifact-manifest.schema.json b/os/spec/artifact-manifest.schema.json
index feb675142..44fe0ab11 100644
--- a/os/spec/artifact-manifest.schema.json
+++ b/os/spec/artifact-manifest.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/Dstack-TEE/dstack/blob/master/os/spec/artifact-manifest.schema.json",
+  "$id": "https://github.com/Dstack-TEE/dstack/blob/next/os/spec/artifact-manifest.schema.json",
   "title": "dstack OS backend artifact manifest",
   "description": "Versioned handoff from an OS build backend to the common image assembler. Artifact paths are relative to the manifest.",
   "$defs": {
diff --git a/os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service b/os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service
index 63b8bcf53..e52f7858e 100644
--- a/os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service
+++ b/os/yocto/layers/meta-dstack/recipes-core/dstack-tee-simulator/files/dstack-tee-simulator.service
@@ -1,6 +1,6 @@
 [Unit]
 Description=dstack development TEE ABI simulator
-Documentation=https://github.com/Dstack-TEE/dstack/blob/master/CONTRIBUTING.md
+Documentation=https://github.com/Dstack-TEE/dstack/blob/next/CONTRIBUTING.md
 Before=dstack-prepare.service
 
 [Service]