diff --git a/.github/actions/release/bump-versions/action.yml b/.github/actions/release/bump-versions/action.yml
index 9a08c24de5..689a276e1d 100644
--- a/.github/actions/release/bump-versions/action.yml
+++ b/.github/actions/release/bump-versions/action.yml
@@ -44,7 +44,7 @@ runs:
       # cargo-release creates a signed commit automatically
       if: ${{inputs.release-target == 'rust'}}
       run: |
-        cargo workspaces version --no-git-commit --exact custom ${{ inputs.version }} -y
+        cargo workspaces version --force "*" --no-git-commit --exact custom ${{ inputs.version }} -y
 
     - name: Bump Wasm bindings crate version
       shell: bash
@@ -52,7 +52,7 @@ runs:
       if: ${{inputs.release-target == 'wasm'}}
       working-directory: bindings/wasm
       run: |
-        cargo workspaces version --no-git-commit --exact custom ${{ inputs.version }} -y
+        cargo workspaces version --force "*" --no-git-commit --exact custom ${{ inputs.version }} -y
 
     - name: Set up Node.js
       uses: actions/setup-node@v2
diff --git a/.github/workflows/rust-automatic-release-and-publish.yml b/.github/workflows/rust-automatic-release-and-publish.yml
index 1d05773d13..4d16525e0c 100644
--- a/.github/workflows/rust-automatic-release-and-publish.yml
+++ b/.github/workflows/rust-automatic-release-and-publish.yml
@@ -5,7 +5,7 @@ on:
   pull_request:
     branches:
       - dev
-      - main
+      - support/v*
     types: [closed]
 jobs:
   call-create-release-workflow:
diff --git a/.github/workflows/rust-create-hotfix-pr.yml b/.github/workflows/rust-create-hotfix-pr.yml
new file mode 100644
index 0000000000..0d0d209014
--- /dev/null
+++ b/.github/workflows/rust-create-hotfix-pr.yml
@@ -0,0 +1,23 @@
+name: Rust Create Hotfix PR
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Name of the support branch (e.g. `support/v1.2`)'
+        required: true
+
+jobs:
+  create-hotfix-pr:
+    # owner/repository of workflow has to be static, see https://github.community/t/env-variables-in-uses/17466
+    uses: iotaledger/identity.rs/.github/workflows/shared-create-hotfix-pr.yml@dev
+    with:
+      branch: ${{ github.event.inputs.branch }}
+      branch-regex: ^support\/v[0-9]+\.[0-9]+$
+      tag-prefix: v
+      main-tag-regex: ^v[0-9]+\.[0-9]+\.[0-9]+$
+      changelog-config-path: ./.github/.github_changelog_generator
+      release-target: rust
+    secrets:
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
diff --git a/.github/workflows/scripts/array.sh b/.github/workflows/scripts/array.sh
new file mode 100755
index 0000000000..9d556635f9
--- /dev/null
+++ b/.github/workflows/scripts/array.sh
@@ -0,0 +1,6 @@
+# joins an array with a delimiter
+joinBy() {
+    local IFS="$1"; shift; echo "$*";
+}
+
+"$@"
\ No newline at end of file
diff --git a/.github/workflows/scripts/updateVersion.sh b/.github/workflows/scripts/updateVersion.sh
new file mode 100755
index 0000000000..b3984cfeb7
--- /dev/null
+++ b/.github/workflows/scripts/updateVersion.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# takes a string and increments the last number
+# e.g. $(updateVersion 1.1.0) -> 1.1.1
+# e.g. $(updateVersion 1.1.0-dev.1) -> 1.1.0-dev.2 
+
+[[ ${1} =~ ^(.*[^0-9])?([0-9]+)$ ]]  && \
+    [[ ${#BASH_REMATCH[1]} -gt 0 ]] && \
+    printf "%s%0${#BASH_REMATCH[2]}d" "${BASH_REMATCH[1]}" "$((10#${BASH_REMATCH[2]} + 1 ))" || \
+    printf "%0${#BASH_REMATCH[2]}d" "$((10#${BASH_REMATCH[2]} + 1))" || \
+    printf "${1}"
diff --git a/.github/workflows/shared-create-dev-release-pr.yml b/.github/workflows/shared-create-dev-release-pr.yml
index 603591ac55..7211ab86b8 100644
--- a/.github/workflows/shared-create-dev-release-pr.yml
+++ b/.github/workflows/shared-create-dev-release-pr.yml
@@ -75,22 +75,8 @@ jobs:
           TAG_BASE=${{ inputs.tag-base }}
           TAG_POSTFIX=${{ inputs.tag-postfix }}
 
-          # joins an array with a delimiter
-          function join_by { local IFS="$1"; shift; echo "$*"; }
-
-          # takes a string and increments the last number
-          # e.g. $(updateVersion 1.1.0-dev.1) -> 1.1.0-dev.2 
-          updateVersion()
-          {
-            [[ ${1} =~ ^(.*[^0-9])?([0-9]+)$ ]]  && \
-              [[ ${#BASH_REMATCH[1]} -gt 0 ]] && \
-                printf "%s%0${#BASH_REMATCH[2]}d" "${BASH_REMATCH[1]}" "$((10#${BASH_REMATCH[2]} + 1 ))" || \
-                printf "%0${#BASH_REMATCH[2]}d" "$((10#${BASH_REMATCH[2]} + 1))" || \
-              printf "${1}"
-          }
-
           # create a list of tags that are unrelated to the current release
-          ALL_TAGS=$(git tag --sort=creatordate -l)
+          ALL_TAGS=$(git tag -l)
           temp_array=()
           for value in ${ALL_TAGS[@]}
           do
@@ -98,7 +84,7 @@ jobs:
                 temp_array+=($value)
               fi
           done
-          UNRELATED_TAGS=$(join_by , "${temp_array[@]}")
+          UNRELATED_TAGS=$(.github/workflows/scripts/array.sh joinBy , "${temp_array[@]}")
           unset temp_array
           echo UNRELATED_TAGS=$UNRELATED_TAGS
           
@@ -113,7 +99,7 @@ jobs:
             SECOND=$UNRELATED_TAGS
             EXCLUDE_ARG=$FIRST$SECOND
           else
-            NEW_DEV_TAG=$(updateVersion $LATEST_DEV_TAG)
+            NEW_DEV_TAG=$(.github/workflows/scripts/updateVersion.sh $LATEST_DEV_TAG)
 
             # exclude dev version already merged in main
             ALL_DEV_TAGS_IN_MAIN=$(git tag -l "$TAG_PREFIX$TAG_BASE$TAG_POSTFIX*" --merged $(git log -n 1 refs/remotes/origin/main --pretty=format:"%H"))
@@ -123,7 +109,7 @@ jobs:
                 [[ $value != $LATEST_DEV_TAG ]] && temp_array+=($value)
             done
             FIRST="--exclude-tags "
-            SECOND=$(join_by , "${temp_array[@]}")
+            SECOND=$(.github/workflows/scripts/array.sh joinBy , "${temp_array[@]}")
             if [[ $SECOND != '' ]]; then
               SECOND+=,
             fi
diff --git a/.github/workflows/shared-create-hotfix-pr.yml b/.github/workflows/shared-create-hotfix-pr.yml
new file mode 100644
index 0000000000..bd5761605a
--- /dev/null
+++ b/.github/workflows/shared-create-hotfix-pr.yml
@@ -0,0 +1,177 @@
+name: Shared / Create Hotfix PR
+
+# This workflow creates a Pull Request meant for creating releases. 
+# A changelog, including the new version, is generated and version strings in relevant files are replaced. 
+# All these changes are committed and submitted as a Pull Request.
+
+on:
+  workflow_call:
+    inputs:
+      branch-regex:
+        description: "regex to validate branch input against"
+        required: true
+        type: string
+      branch:
+        description: "branch to hotfix on"
+        required: true
+        type: string
+      tag-prefix:
+        description: "will be pre-pended to tag-base"
+        required: false
+        type: string
+      main-tag-regex:
+        description: "the regex to find all related main releases"
+        required: true
+        type: string
+      changelog-path:
+        description: "path to the changelog file"
+        required: false
+        default: ./CHANGELOG.md
+        type: string
+      changelog-config-path:
+        description: "path to the changelog config"
+        required: true
+        type: string
+      pr-body-text:
+        description: "text to be included in the PR"
+        required: false
+        type: string
+      release-target:
+        description: "target of the release (rust|wasm)"
+        required: true
+        type: string
+    secrets:
+      GPG_PRIVATE_KEY:
+        description: "GPG private key for signing commits and tags"
+        required: true
+      GPG_PASSPHRASE:
+        description: "GPG private passphrase for signing commits and tags"
+        required: true
+        
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Validate branch
+        run: |
+          if ! [[ ${{ inputs.branch }} =~ ${{ inputs.branch-regex }} ]]; then
+            echo unrecognized branch ${{ inputs.branch }}, must match ${{ inputs.branch-regex }}
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          # Number of commits to fetch. 0 indicates all history for all branches and tags.
+          fetch-depth: 0
+          ref: ${{ inputs.branch }}
+
+      - name: Determine Hotfix Version
+        run: |
+
+          TAG_PREFIX=${{ inputs.tag-prefix }}
+          BRANCHNAME=${{ inputs.branch }}
+
+          SUPPORT_TAG_BASE=${BRANCHNAME##*/}
+
+          ALL_TAGS=$(git tag --sort=-version:refname -l)
+          temp_array=()
+          for value in ${ALL_TAGS[@]}
+          do
+              # consider tags matching the RegEx for main tags and matching the support branch base
+              if [[ $value =~ ${{ inputs.main-tag-regex }} && $value == $SUPPORT_TAG_BASE* ]]; then
+                LATEST_TAG=$value
+                break
+              fi
+          done
+          unset temp_array
+          echo LATEST_TAG=$LATEST_TAG
+
+          HOTFIX_TAG=$(.github/workflows/scripts/updateVersion.sh $LATEST_TAG)
+          echo HOTFIX_TAG=$HOTFIX_TAG
+          echo HOTFIX_TAG=$HOTFIX_TAG >> $GITHUB_ENV
+
+          HOTFIX_VERSION=$(echo "$HOTFIX_TAG" | sed "s/$TAG_PREFIX*//")
+          echo HOTFIX_VERSION=$HOTFIX_VERSION
+          echo HOTFIX_VERSION=$HOTFIX_VERSION >> $GITHUB_ENV
+
+      - name: Determine Excluded Tags
+        run: |
+          # create a list of tags that are unrelated to the current release
+          ALL_TAGS=$(git tag -l)
+          temp_array=()
+          for value in ${ALL_TAGS[@]}
+          do
+              if ! [[ $value =~ ${{ inputs.main-tag-regex }} && $(git branch -a --contains $value | grep ${{ inputs.branch }}) ]]; then
+                temp_array+=($value)
+              fi
+          done
+          UNRELATED_TAGS=$(.github/workflows/scripts/array.sh joinBy , "${temp_array[@]}")
+          unset temp_array
+          echo UNRELATED_TAGS=$UNRELATED_TAGS
+
+          # set variables
+          FIRST="--exclude-tags "
+          SECOND=$UNRELATED_TAGS
+          EXCLUDE_ARG=$FIRST$SECOND
+          echo EXCLUDE_ARG=$EXCLUDE_ARG
+          echo EXCLUDE_ARG=$EXCLUDE_ARG >> $GITHUB_ENV
+
+      - name: Run Changelog Generator
+        uses: './.github/actions/release/changelog-generator'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          changelog-path: ${{ inputs.changelog-path }}
+          changelog-config-path: ${{ inputs.changelog-config-path }}
+          future-release: ${{ env.HOTFIX_TAG }} 
+          optional-arg: ${{env.EXCLUDE_ARG}}
+
+      - name: Check Changelog For Modification
+        run: |
+          git add .
+          if [[ $(git diff --stat --staged) == '' ]]; then
+            echo 'repository unmodified'
+            exit 1
+          fi
+
+      - name: Import GPG key
+        id: import-gpg
+        uses: crazy-max/ghaction-import-gpg@cb4264d3319acaa2bea23d51ef67f80b4f775013
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          git_tag_gpgsign: true
+
+      - name: Bump Versions
+        uses: './.github/actions/release/bump-versions'
+        with:
+          release-target: ${{inputs.release-target}}
+          version: ${{ env.HOTFIX_VERSION }} 
+
+      - name: Commit changes
+        run: |
+          git add .
+          if [[ $(git diff --stat --staged) == '' ]]; then
+            echo 'repository unmodified'
+            exit 1
+          fi
+          git commit -m "changelog and versions"
+          
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@67df31e08a133c6a77008b89689677067fef169e
+        with:
+          committer: GitHub <noreply@github.com>
+          author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
+          branch: hotfix/${{ env.HOTFIX_TAG }} 
+          delete-branch: true
+          title: 'Hotfix ${{ env.HOTFIX_TAG }}'
+          body: |
+            This automatically generated PR contains changes for the `${{ env.HOTFIX_TAG }}` hotfix.
+            ${{inputs.pr-body-text}}
+            If you discover any mistakes fix them with commits on this branch. If you want to abort the hotfix simply close the PR.
+          labels: |
+            No changelog
+      
diff --git a/.github/workflows/shared-create-main-release-pr.yml b/.github/workflows/shared-create-main-release-pr.yml
index 30b67006c9..7cbd8d9410 100644
--- a/.github/workflows/shared-create-main-release-pr.yml
+++ b/.github/workflows/shared-create-main-release-pr.yml
@@ -8,7 +8,7 @@ on:
   workflow_call:
     inputs:
       tag-prefix:
-        description: "will be prepended to tag-base"
+        description: "will be pre-pended to tag-base"
         required: false
         type: string
       tag-base:
@@ -69,10 +69,6 @@ jobs:
 
       - name: Determine Excluded Tags
         run: |
-
-          # joins an array with a delimiter
-          function join_by { local IFS="$1"; shift; echo "$*"; }
-
           # create a list of tags that are unrelated to the current release
           ALL_TAGS=$(git tag -l)
           temp_array=()
@@ -82,7 +78,7 @@ jobs:
                 temp_array+=($value)
               fi
           done
-          UNRELATED_TAGS=$(join_by , "${temp_array[@]}")
+          UNRELATED_TAGS=$(.github/workflows/scripts/array.sh joinBy , "${temp_array[@]}")
           unset temp_array
           echo UNRELATED_TAGS=$UNRELATED_TAGS
 
diff --git a/.github/workflows/shared-release.yml b/.github/workflows/shared-release.yml
index 220ff6502b..48446446a8 100644
--- a/.github/workflows/shared-release.yml
+++ b/.github/workflows/shared-release.yml
@@ -77,9 +77,9 @@ jobs:
           echo "::set-output name=is-release::=$IS_RELEASE"
           if [[ $(echo $CURRENT_VERSION | grep -w -P '${{ inputs.dev-tag-regex }}') ]]; then
             IS_DEV_RELEASE=true
-            PREVIOUS_VERSION=$(git tag --sort=-committerdate | grep -w -P '${{ inputs.dev-tag-regex }}' | head -n 1)
+            PREVIOUS_VERSION=$(git tag -l --sort=-version:refname --merged $(git log -n 1 refs/remotes/origin/$(git rev-parse --abbrev-ref HEAD) --pretty=format:"%H") | grep -w -P '${{ inputs.dev-tag-regex }}' | head -n 1)
           else
-            PREVIOUS_VERSION=$(git tag --sort=-committerdate | grep -w -P '${{ inputs.main-tag-regex }}' | head -n 1)
+            PREVIOUS_VERSION=$(git tag -l --sort=-version:refname --merged $(git log -n 1 refs/remotes/origin/$(git rev-parse --abbrev-ref HEAD) --pretty=format:"%H") | grep -w -P '${{ inputs.main-tag-regex }}' | head -n 1)
           fi
 
           if [[ $PREVIOUS_VERSION ]]; then
diff --git a/.github/workflows/wasm-automatic-release-and-publish.yml b/.github/workflows/wasm-automatic-release-and-publish.yml
index d3651aa851..16febc378a 100644
--- a/.github/workflows/wasm-automatic-release-and-publish.yml
+++ b/.github/workflows/wasm-automatic-release-and-publish.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches:
       - dev
-      - main
+      - support/wasm-v*
     types: [closed]
 jobs:
   call-create-release-workflow:
diff --git a/.github/workflows/wasm-create-hotfix-pr.yml b/.github/workflows/wasm-create-hotfix-pr.yml
new file mode 100644
index 0000000000..3c79ae5800
--- /dev/null
+++ b/.github/workflows/wasm-create-hotfix-pr.yml
@@ -0,0 +1,24 @@
+name: Wasm Create Hotfix PR
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Name of the support branch (e.g. `support/wasm-v1.2`)'
+        required: true
+
+jobs:
+  create-hotfix-pr:
+    # owner/repository of workflow has to be static, see https://github.community/t/env-variables-in-uses/17466
+    uses: iotaledger/identity.rs/.github/workflows/shared-create-hotfix-pr.yml@dev
+    with:
+      branch: ${{ github.event.inputs.branch }}
+      branch-regex: ^support\/wasm-v[0-9]+\.[0-9]+$
+      tag-prefix: wasm-v
+      main-tag-regex: ^wasm-v[0-9]+\.[0-9]+\.[0-9]+$
+      changelog-config-path: ./bindings/wasm/.github_changelog_generator
+      changelog-path: ./bindings/wasm/CHANGELOG.md
+      release-target: wasm
+    secrets:
+      GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}