diff --git a/.github/workflows/redhat-certify.yml b/.github/workflows/redhat-certify.yml
new file mode 100644
index 000000000..e592dabc2
--- /dev/null
+++ b/.github/workflows/redhat-certify.yml
@@ -0,0 +1,199 @@
+name: Red Hat Certification
+
+# Certify published UBI images in the Red Hat Ecosystem Catalog. Called by
+# release.yml on stable tags, or run by hand to (re)certify any released
+# version. preflight submits every architecture of an image's manifest list
+# to Pyxis; auto-publish on the component makes it public once certified.
+#
+# Each component's Partner Connect ID comes from the REDHAT_CERT_ID_<NAME>
+# repository variable, e.g. REDHAT_CERT_ID_CLIENT_ROOTLESS. The run fails
+# before certifying anything if a selected component's variable is not set.
+
+on:
+  workflow_call:
+    inputs:
+      component:
+        type: string
+        required: true
+      version:
+        type: string
+        required: true
+    secrets:
+      PYXIS_API_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      component:
+        description: "Component to certify"
+        type: choice
+        required: true
+        default: all
+        options:
+          - all
+          - client-rootless
+          - reverse-proxy
+      version:
+        description: "Released version, e.g. v0.80.0"
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  resolve:
+    name: Resolve components
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.resolve.outputs.version }}
+      matrix: ${{ steps.resolve.outputs.matrix }}
+    steps:
+      - name: Resolve components and images
+        id: resolve
+        env:
+          COMPONENT: ${{ inputs.component }}
+          INPUT_VERSION: ${{ inputs.version }}
+          REPO_VARS: ${{ toJSON(vars) }}
+        run: |
+          set -euo pipefail
+          version="${INPUT_VERSION#v}"
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Only stable x.y.z versions are certified, got '${INPUT_VERSION}'"
+            exit 1
+          fi
+          # name, image repository, tag suffix (must match .goreleaser.yaml).
+          # Keep the names in sync with the workflow_dispatch options above.
+          components=(
+            "client-rootless ghcr.io/netbirdio/netbird -rootless-ubi"
+            "reverse-proxy ghcr.io/netbirdio/reverse-proxy -ubi"
+          )
+          matrix="[]"
+          missing=()
+          for c in "${components[@]}"; do
+            read -r name repo suffix <<< "$c"
+            [[ "$COMPONENT" == all || "$COMPONENT" == "$name" ]] || continue
+            var="REDHAT_CERT_ID_${name^^}"; var="${var//-/_}"
+            id="$(jq -r --arg v "$var" '.[$v] // empty' <<< "$REPO_VARS")"
+            if [[ -z "$id" ]]; then
+              missing+=("$var")
+              continue
+            fi
+            matrix="$(jq -c --arg n "$name" --arg t "${version}${suffix}" --arg r "${repo}:${version}${suffix}" --arg i "$id" \
+              '. + [{component: $n, tag: $t, ref: $r, component_id: $i}]' <<< "$matrix")"
+          done
+          if (( ${#missing[@]} )); then
+            echo "::error::Set these repository variables to the Partner Connect component IDs: ${missing[*]}"
+            exit 1
+          fi
+          if [[ "$matrix" == "[]" ]]; then
+            echo "::error::No component to certify for '${COMPONENT}'"
+            exit 1
+          fi
+          echo "Components to certify: ${matrix}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
+
+  certify:
+    name: "Certify ${{ matrix.component }} UBI image"
+    needs: resolve
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.resolve.outputs.matrix) }}
+    env:
+      PREFLIGHT_VERSION: "1.21.0"
+      # sha256 of preflight-linux-amd64 from the 1.21.0 GitHub release.
+      # Red Hat publishes no checksum file, so the value is pinned here.
+      PREFLIGHT_SHA256: "5e653135503c72f8702bbe31d7643197d12937c68086879133dd6b9650a9a449"
+    steps:
+      - name: Verify the multi-arch image is on ghcr.io
+        env:
+          IMAGE_REF: ${{ matrix.ref }}
+        run: |
+          set -euo pipefail
+          docker buildx imagetools inspect "$IMAGE_REF" --raw > manifest.json
+          for arch in amd64 arm64; do
+            if ! jq -e --arg a "$arch" '.manifests[] | select(.platform.architecture == $a)' manifest.json > /dev/null; then
+              echo "::error::${IMAGE_REF} has no ${arch} manifest"
+              exit 1
+            fi
+          done
+          echo "Manifest list for ${IMAGE_REF}:"
+          jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture) \(.digest)"' manifest.json
+
+      - name: Install preflight
+        run: |
+          set -euo pipefail
+          curl -fsSL --proto '=https' --proto-redir '=https' -o preflight \
+            "https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${PREFLIGHT_VERSION}/preflight-linux-amd64"
+          echo "${PREFLIGHT_SHA256}  preflight" | sha256sum -c -
+          chmod +x preflight
+          ./preflight --version
+
+      - name: Run preflight checks and submit to Red Hat
+        env:
+          IMAGE_REF: ${{ matrix.ref }}
+          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
+          PFLT_CERTIFICATION_COMPONENT_ID: ${{ matrix.component_id }}
+          PFLT_ARTIFACTS: artifacts
+          PFLT_LOGFILE: artifacts/preflight.log
+          PFLT_LOGLEVEL: info
+          PFLT_JUNIT: "true"
+        run: |
+          set -euo pipefail
+          # No --platform: preflight walks the manifest list and submits every
+          # architecture in one run, grouped under one manifest-list digest.
+          # preflight does not create the PFLT_LOGFILE directory, and --submit
+          # fails if the log file is missing.
+          mkdir -p artifacts
+          ./preflight check container "$IMAGE_REF" --submit
+
+      - name: Fail if any check did not pass
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          results=(artifacts/results.json artifacts/*/results.json)
+          if [[ ${#results[@]} -eq 0 ]]; then
+            echo "::error::preflight produced no results.json"
+            exit 1
+          fi
+          status=0
+          for f in "${results[@]}"; do
+            arch="$(basename "$(dirname "$f")")"
+            passed="$(jq -r '.passed' "$f")"
+            failed="$(jq -r '[.results.failed[]?.name] | join(", ")' "$f")"
+            echo "${arch}: passed=${passed} ${failed:+failed checks: ${failed}}"
+            [[ "$passed" == "true" ]] || status=1
+          done
+          exit $status
+
+      - name: Upload preflight artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: redhat-preflight-${{ matrix.component }}-${{ needs.resolve.outputs.version }}
+          path: artifacts/
+          retention-days: 30
+
+      - name: Wait for Pyxis to mark both architectures certified
+        env:
+          TAG: ${{ matrix.tag }}
+          COMPONENT_ID: ${{ matrix.component_id }}
+          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Filter on the tag server-side so older versions are found past the first page.
+          url="https://catalog.redhat.com/api/containers/v1/projects/certification/id/${COMPONENT_ID}/images?filter=repositories.tags.name==${TAG}&page_size=100"
+          for attempt in $(seq 1 20); do
+            certified="$(curl -fsS --proto '=https' --proto-redir '=https' -H "X-API-KEY: ${PFLT_PYXIS_API_TOKEN}" "$url" \
+              | jq -r --arg t "$TAG" '[.data[] | select(.repositories[]?.tags[]?.name == $t) | select(.certified == true) | .architecture] | unique | join(",")')"
+            echo "attempt ${attempt}: certified architectures for ${TAG}: ${certified:-none}"
+            if [[ "$certified" == "amd64,arm64" ]]; then
+              echo "Both architectures certified. Auto-publish is enabled on the component, so the catalog updates on its own."
+              exit 0
+            fi
+            sleep 30
+          done
+          echo "::error::Pyxis has not marked both architectures certified after 10 minutes. Check https://connect.redhat.com/component/view/${COMPONENT_ID}/images"
+          exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9c9af5f17..dee4d398d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -380,131 +380,23 @@ jobs:
           path: dist/netbird_darwin**
           retention-days: 7
 
-  # Certify and publish the rootless UBI client image in the Red Hat Ecosystem
-  # Catalog. Stable tags only: goreleaser pushes <version>-rootless-ubi to
-  # ghcr.io in the release job above, and preflight submits every architecture
-  # of that manifest list to Pyxis. Auto-publish on the component makes the new
-  # version public once certification passes.
+  # Certify the UBI images in the Red Hat Ecosystem Catalog on stable tags.
+  # See redhat-certify.yml, which can also be run by hand for any released version.
   redhat_certification:
-    name: "Red Hat / Certify rootless UBI image"
+    name: "Red Hat"
     needs: release
     if: |
       github.repository == 'netbirdio/netbird' &&
       startsWith(github.ref, 'refs/tags/v') &&
       !contains(github.ref_name, '-')
-    runs-on: ubuntu-24.04
     permissions:
       contents: read
-    env:
-      PREFLIGHT_VERSION: "1.21.0"
-      # sha256 of preflight-linux-amd64 from the 1.21.0 GitHub release.
-      # Red Hat publishes no checksum file, so the value is pinned here.
-      PREFLIGHT_SHA256: "5e653135503c72f8702bbe31d7643197d12937c68086879133dd6b9650a9a449"
-      IMAGE_REPOSITORY: "ghcr.io/netbirdio/netbird"
-      # Component "NetBird Client Container Image (rootless)" in Partner Connect.
-      # Override with the REDHAT_CERT_COMPONENT_ID repository variable if it changes.
-      DEFAULT_COMPONENT_ID: "6aa3ca4b4676aefdf07aaa97"
-    steps:
-      - name: Resolve image reference
-        id: image
-        env:
-          INPUT_VERSION: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          version="${INPUT_VERSION#v}"
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Only stable x.y.z versions are certified, got '${INPUT_VERSION}'"
-            exit 1
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-          echo "ref=${IMAGE_REPOSITORY}:${version}-rootless-ubi" >> "$GITHUB_OUTPUT"
-
-      - name: Verify the multi-arch image is on ghcr.io
-        env:
-          IMAGE_REF: ${{ steps.image.outputs.ref }}
-        run: |
-          set -euo pipefail
-          docker buildx imagetools inspect "$IMAGE_REF" --raw > manifest.json
-          for arch in amd64 arm64; do
-            if ! jq -e --arg a "$arch" '.manifests[] | select(.platform.architecture == $a)' manifest.json > /dev/null; then
-              echo "::error::${IMAGE_REF} has no ${arch} manifest"
-              exit 1
-            fi
-          done
-          echo "Manifest list for ${IMAGE_REF}:"
-          jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture) \(.digest)"' manifest.json
-
-      - name: Install preflight
-        run: |
-          set -euo pipefail
-          curl -fsSL --proto '=https' --proto-redir '=https' -o preflight \
-            "https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${PREFLIGHT_VERSION}/preflight-linux-amd64"
-          echo "${PREFLIGHT_SHA256}  preflight" | sha256sum -c -
-          chmod +x preflight
-          ./preflight --version
-
-      - name: Run preflight checks and submit to Red Hat
-        env:
-          IMAGE_REF: ${{ steps.image.outputs.ref }}
-          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
-          PFLT_CERTIFICATION_COMPONENT_ID: ${{ vars.REDHAT_CERT_COMPONENT_ID || env.DEFAULT_COMPONENT_ID }}
-          PFLT_ARTIFACTS: artifacts
-          PFLT_LOGFILE: artifacts/preflight.log
-          PFLT_LOGLEVEL: info
-          PFLT_JUNIT: "true"
-        run: |
-          set -euo pipefail
-          # No --platform: preflight walks the manifest list and submits every
-          # architecture in one run, grouped under one manifest-list digest.
-          ./preflight check container "$IMAGE_REF" --submit
-
-      - name: Fail if any check did not pass
-        run: |
-          set -euo pipefail
-          shopt -s nullglob
-          results=(artifacts/results.json artifacts/*/results.json)
-          if [[ ${#results[@]} -eq 0 ]]; then
-            echo "::error::preflight produced no results.json"
-            exit 1
-          fi
-          status=0
-          for f in "${results[@]}"; do
-            arch="$(basename "$(dirname "$f")")"
-            passed="$(jq -r '.passed' "$f")"
-            failed="$(jq -r '[.results.failed[]?.name] | join(", ")' "$f")"
-            echo "${arch}: passed=${passed} ${failed:+failed checks: ${failed}}"
-            [[ "$passed" == "true" ]] || status=1
-          done
-          exit $status
-
-      - name: Upload preflight artifacts
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: redhat-preflight-${{ steps.image.outputs.version }}
-          path: artifacts/
-          retention-days: 30
-
-      - name: Wait for Pyxis to mark both architectures certified
-        env:
-          VERSION: ${{ steps.image.outputs.version }}
-          PFLT_PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
-          COMPONENT_ID: ${{ vars.REDHAT_CERT_COMPONENT_ID || env.DEFAULT_COMPONENT_ID }}
-        run: |
-          set -euo pipefail
-          tag="${VERSION}-rootless-ubi"
-          url="https://catalog.redhat.com/api/containers/v1/projects/certification/id/${COMPONENT_ID}/images?page_size=100"
-          for attempt in $(seq 1 20); do
-            certified="$(curl -fsS --proto '=https' --proto-redir '=https' -H "X-API-KEY: ${PFLT_PYXIS_API_TOKEN}" "$url" \
-              | jq -r --arg t "$tag" '[.data[] | select(.repositories[]?.tags[]?.name == $t) | select(.certified == true) | .architecture] | unique | join(",")')"
-            echo "attempt ${attempt}: certified architectures for ${tag}: ${certified:-none}"
-            if [[ "$certified" == "amd64,arm64" ]]; then
-              echo "Both architectures certified. Auto-publish is enabled on the component, so the catalog updates on its own."
-              exit 0
-            fi
-            sleep 30
-          done
-          echo "::warning::Pyxis has not marked both architectures certified after 10 minutes. Check https://connect.redhat.com/component/view/${COMPONENT_ID}/images"
+    uses: ./.github/workflows/redhat-certify.yml
+    with:
+      component: all
+      version: ${{ github.ref_name }}
+    secrets:
+      PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }}
 
   release_ui:
     runs-on: ubuntu-latest