diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cca2a7f..4c0c576 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,13 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with: { cache: yarn, node-version-file: .node-version }
 
+      - name: Mint release token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
       - name: Ensure release runs from main
         run: |
           if [ "${{ github.ref }}" != "refs/heads/main" ]; then
@@ -63,6 +70,7 @@ jobs:
           VERSION: ${{ steps.bump.outputs.version }}
           VERSION_FILES: ${{ steps.bump.outputs.files }}
         with:
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const fs = require('fs')
 
@@ -146,6 +154,7 @@ jobs:
           COMMIT_SHA: ${{ steps.commit.outputs.sha }}
           VERSION_TAG: ${{ steps.bump.outputs.tag }}
         with:
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const { owner, repo } = context.repo
             const tag = process.env.VERSION_TAG