diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 42849553c3..f63965f81c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1952,23 +1952,46 @@ pairwise:
     variables:
       - $PAIRWISE_TESTING
 
-backports:
+.post_merge_template: &post_merge
   <<: *base_image
   stage: postmerge
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  needs: []
+  # post-merge processes should run even if another MR was merged while the job was running (or queued)
+  interruptible: false
   variables:
     # automated commits will inherit identification from the user who pressed Merge button
     GIT_COMMITTER_NAME: $GITLAB_USER_NAME
     GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
     # avoid leftover branches from previous jobs
     GIT_STRATEGY: clone
-    # assumed max depth of a MR for backport
-    GIT_DEPTH: 200
+    # assumed max depth of a MR for backport or a rebased force-push
+    GIT_DEPTH: 1000
+  before_script:
+    # force-pushes should not trigger process automation (happens only in -sub branches)
+    - >
+      echo "previous branch tip: $CI_COMMIT_BEFORE_SHA"
+    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
+    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
+    # non-fast-forward merges are disabled so we have to have merge commit on top
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
+    - >
+      : stop if this is not a merge request
+    - test "$MERGE_REQUEST_ID" -ge 0
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+
+backports:
+  <<: *post_merge
+  rules:
+    # -sub branches are handled manually
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
   script:
     # CI job token is not sufficient for push operations
     - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
-    # force-pushing is disabled so we have to have merge request on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
     - bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"
+
+merged-metadata:
+  <<: *post_merge
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+  script:
+    - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"
diff --git a/dangerfile.py b/dangerfile.py
index 00f3a8a44c..93127eaaf5 100644
--- a/dangerfile.py
+++ b/dangerfile.py
@@ -202,15 +202,6 @@ for commit in danger.git.commits:
                 f"```{line}``` ({len(line)} > 72 characters)."
             )
 
-###############################################################################
-# MILESTONE
-###############################################################################
-#
-# FAIL if the merge request is not assigned to any milestone.
-
-if not danger.gitlab.mr.milestone:
-    fail("Please assign this merge request to a milestone.")
-
 ###############################################################################
 # BACKPORT & VERSION LABELS
 ###############################################################################
@@ -331,31 +322,6 @@ elif not approved:
         "It should not be merged until it is approved."
     )
 
-###############################################################################
-# Changelog entries
-###############################################################################
-#
-# FAIL if any of the following is true:
-#
-# * The merge request title doesn't produce a changelog entry, but it does not have
-#   the "No CHANGES" label set.
-#
-# * The merge request title produces a changelog entry, but it has the "No CHANGES"
-#   label set.
-
-changes_modified = mr_title_audience in ["usr", "pkg", "dev"]
-no_changes_label_set = "No CHANGES" in mr_labels
-if not changes_modified and not no_changes_label_set:
-    fail(
-        "MR title doesn't produce a new changelog entry. "
-        "Add a `dev:`|`usr:`|`pkg:` audience to MR title or set the *No CHANGES* label."
-    )
-if changes_modified and no_changes_label_set:
-    fail(
-        "MR title produces a new changelog entry. Unset the *No Changes* label "
-        "or remove the `dev:`|`usr:`|`pkg:` audience from the MR title."
-    )
-
 ###############################################################################
 # RELEASE NOTES
 ###############################################################################
@@ -389,15 +355,8 @@ if changes_modified and no_changes_label_set:
 #       linked with the `Closes` or `Fixes` keyword in the MR description.
 
 release_notes_changed = mr_title_audience in ["usr", "pkg"]
-release_notes_label_set = "Release Notes" in mr_labels
 if not release_notes_changed:
-    if release_notes_label_set:
-        fail(
-            "This merge request has the *Release Notes* label set. "
-            "Update the MR title to include `usr:`|`pkg:` audience or "
-            "unset the *Release Notes* label."
-        )
-    elif "Customer" in mr_labels:
+    if "Customer" in mr_labels and not release_notes_changed:
         warn(
             "This merge request has the *Customer* label set. "
             "Update the MR title to include `usr:`|`pkg:` audience "
@@ -413,20 +372,6 @@ if not release_notes_changed:
             "means that it adds support for a new RR type or removes support "
             "for an existing one. Update the MR title to include `usr:` audience."
         )
-if release_notes_changed and not release_notes_label_set:
-    fail(
-        "The MR title produces a release note. Set the *Release Notes* label "
-        "or remove the `usr:`|`pkg:` audience from the MR title."
-    )
-if (
-    release_notes_label_set
-    and no_changes_label_set
-    and not ("Documentation" in mr_labels or "Release" in mr_labels)
-):
-    fail(
-        "This merge request is labeled with both *Release notes* and *No CHANGES*. "
-        "A user-visible change should also be mentioned in the changelog."
-    )
 
 if release_notes_changed and not mr_issue_link_regex.search(
     danger.gitlab.mr.description