diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1ae1560..9338005 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,7 +21,20 @@ jobs:
       pull-requests: write
       id-token: write # npm OIDC trusted publishing - no NPM_TOKEN secret needed
     steps:
+      - name: Mint release app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false # changesets/action writes its own credential from the app token
 
       - uses: pnpm/action-setup@v4
         with:
@@ -49,5 +62,5 @@ jobs:
           commit: "chore: version packages"
           title: "chore: version packages"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} # app token, so the version PR's pushes start CI
           NPM_CONFIG_PROVENANCE: true