diff --git a/.gitea/workflows/server-release.yml b/.gitea/workflows/server-release.yml
new file mode 100644
index 0000000..ee022d9
--- /dev/null
+++ b/.gitea/workflows/server-release.yml
@@ -0,0 +1,111 @@
+name: Auto-rebuild on Server Release
+
+on:
+  repository_dispatch:
+    types: [server-release]
+
+env:
+  GOPROXY: https://proxy.golang.org,direct
+  GOPRIVATE: git.marketally.com
+  GONOSUMDB: git.marketally.com
+
+jobs:
+  update-and-release:
+    name: Update Server Version and Release
+    runs-on: linux-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
+
+      - name: Extract dispatch payload
+        id: payload
+        run: |
+          SERVER_TAG="${{ github.event.client_payload.server_tag }}"
+          SERVER_SHA="${{ github.event.client_payload.server_sha }}"
+          SERVER_PSEUDO="${{ github.event.client_payload.server_pseudo_version }}"
+
+          echo "Server tag: $SERVER_TAG"
+          echo "Server SHA: $SERVER_SHA"
+          echo "Server pseudo-version: $SERVER_PSEUDO"
+
+          echo "server_tag=$SERVER_TAG" >> "$GITHUB_OUTPUT"
+          echo "server_sha=$SERVER_SHA" >> "$GITHUB_OUTPUT"
+          echo "server_pseudo=$SERVER_PSEUDO" >> "$GITHUB_OUTPUT"
+
+      - name: Determine next vault version
+        id: version
+        run: |
+          # Get the latest vault tag
+          LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "v1.0.0")
+          echo "Latest vault tag: $LATEST_TAG"
+
+          # Parse version components (v1.0.4 -> 1 0 4)
+          VERSION=${LATEST_TAG#v}
+          MAJOR=$(echo $VERSION | cut -d. -f1)
+          MINOR=$(echo $VERSION | cut -d. -f2)
+          PATCH=$(echo $VERSION | cut -d. -f3)
+
+          # Bump patch version
+          NEW_PATCH=$((PATCH + 1))
+          NEW_VERSION="v${MAJOR}.${MINOR}.${NEW_PATCH}"
+
+          echo "New vault version: $NEW_VERSION"
+          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Update build workflow with new server version
+        run: |
+          SERVER_TAG="${{ steps.payload.outputs.server_tag }}"
+          SERVER_SHA="${{ steps.payload.outputs.server_sha }}"
+          SERVER_PSEUDO="${{ steps.payload.outputs.server_pseudo }}"
+          SHORT_SHA="${SERVER_SHA:0:12}"
+
+          echo "Updating GITCADDY_SERVER_VERSION to $SERVER_PSEUDO"
+
+          # Update the version comment and value in build.yml
+          sed -i "s|# v[0-9.]* commit [a-f0-9]* from .*|# $SERVER_TAG commit $SHORT_SHA (auto-updated by server release)|" .gitea/workflows/build.yml
+          sed -i "s|GITCADDY_SERVER_VERSION: \"v0\.0\.0-[0-9]*-[a-f0-9]*\"|GITCADDY_SERVER_VERSION: \"$SERVER_PSEUDO\"|" .gitea/workflows/build.yml
+
+          echo "Updated build.yml:"
+          grep -A1 "GITCADDY_SERVER_VERSION" .gitea/workflows/build.yml
+
+      - name: Configure git
+        run: |
+          git config user.name "GitCaddy Bot"
+          git config user.email "bot@gitcaddy.com"
+
+      - name: Commit and tag
+        run: |
+          SERVER_TAG="${{ steps.payload.outputs.server_tag }}"
+          NEW_VERSION="${{ steps.version.outputs.new_version }}"
+
+          git add .gitea/workflows/build.yml
+
+          # Check if there are changes to commit
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git commit -m "build: auto-update server dependency to $SERVER_TAG
+
+          Triggered by server release $SERVER_TAG.
+          Vault $NEW_VERSION is compatible with server $SERVER_TAG+.
+
+          🤖 Auto-generated by GitCaddy CI"
+
+          git tag -a "$NEW_VERSION" -m "Vault $NEW_VERSION for server $SERVER_TAG
+
+          This release is compatible with gitcaddy-server $SERVER_TAG and later.
+
+          🤖 Auto-generated by GitCaddy CI"
+
+          echo "Created tag $NEW_VERSION"
+
+      - name: Push changes and tag
+        run: |
+          git push origin main
+          git push origin "${{ steps.version.outputs.new_version }}"
+          echo "Pushed ${{ steps.version.outputs.new_version }} - build.yml will now trigger the full build"
diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
new file mode 100644
index 0000000..53b5ad6
--- /dev/null
+++ b/COMPATIBILITY.md
@@ -0,0 +1,49 @@
+# GitCaddy Vault Compatibility
+
+## Version Compatibility Matrix
+
+| Vault Version | Server Version | Notes |
+|---------------|----------------|-------|
+| v1.0.4        | v3.0.6+        | Solo tier with limited versioning/CI-CD |
+| v1.0.3        | v3.0.6+        | Build failed - use v1.0.4 |
+| v1.0.2        | v3.0.5         | Initial public release |
+
+## Important Notes
+
+### Go Plugin Versioning
+
+GitCaddy Vault is distributed as a Go plugin (`.so` file). Go plugins require **exact package version matching** between the plugin and the host application.
+
+This means:
+- Each vault release is built against a specific server version
+- A vault plugin built for server v3.0.5 will **not** load on server v3.0.6
+- Always use the vault version that matches your server version
+
+### Automatic Rebuilds
+
+When a new server version is released, the vault is automatically rebuilt:
+
+1. Server CI tags a new release (e.g., `v3.0.7`)
+2. Server CI triggers a repository dispatch to the vault repo
+3. Vault CI updates its server dependency and tags a new release (e.g., `v1.0.5`)
+4. Vault CI builds and uploads the new `.so` files
+
+### Finding the Right Version
+
+To find which vault version to use:
+
+1. Check your server version: `gitea --version`
+2. Find the matching vault release in this compatibility matrix
+3. Download the vault `.so` for your platform from the release
+
+### Upgrading
+
+When upgrading the server:
+
+1. Stop the server
+2. Replace the server binary
+3. Download the matching vault plugin version
+4. Replace the vault `.so` in your plugins directory
+5. Start the server
+
+Both server and vault must be upgraded together.