diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6996bc9..6c6226f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,11 +2,13 @@ name: release
 on:
   push:
     branches: [main]
+# The workflow token only reads. Every write (the Release commit, the v* tag,
+# the GitHub release and its comments) uses a token minted from the release
+# GitHub App, which is the one actor allowed to push to protected main and to
+# create v* tags.
 permissions:
-  contents: write   # commit the version bump + tag, push, create the release
+  contents: read
   id-token: write   # npm OIDC trusted publishing + provenance
-  issues: write
-  pull-requests: write
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
@@ -14,9 +16,17 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0        # full history + tags for version analysis
+          # The checkout's saved credentials are what `git push` uses, so they
+          # must be the App's, not the workflow token's.
+          token: ${{ steps.app-token.outputs.token }}
       - uses: pnpm/action-setup@v3
       - uses: actions/setup-node@v4
         with:
@@ -25,10 +35,9 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - run: pnpm exec semantic-release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # The release commit is authored and committed by whoever made the commit that
-          # triggered this release (the merge or push to main), not a fixed identity.
-          GIT_AUTHOR_NAME: ${{ github.event.head_commit.author.name }}
-          GIT_AUTHOR_EMAIL: ${{ github.event.head_commit.author.email }}
-          GIT_COMMITTER_NAME: ${{ github.event.head_commit.author.name }}
-          GIT_COMMITTER_EMAIL: ${{ github.event.head_commit.author.email }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          # The release commit is the App's work, so it is authored as the App's bot.
+          GIT_AUTHOR_NAME: agenttrail-public-release[bot]
+          GIT_AUTHOR_EMAIL: 338791256+agenttrail-public-release[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: agenttrail-public-release[bot]
+          GIT_COMMITTER_EMAIL: 338791256+agenttrail-public-release[bot]@users.noreply.github.com