diff --git a/.github/workflows/scoop-token-rehearsal.yml b/.github/workflows/scoop-token-rehearsal.yml
new file mode 100644
index 0000000..8740cfd
--- /dev/null
+++ b/.github/workflows/scoop-token-rehearsal.yml
@@ -0,0 +1,29 @@
+name: Scoop token rehearsal
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/scoop-token-rehearsal.yml'
+
+permissions: {}
+
+jobs:
+  token:
+    name: Mint bucket-scoped Release App token
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Create bucket token
+        id: app-token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+          app-id: ${{ vars.MEIGMA_RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.MEIGMA_RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: scoop-bucket
+
+      - name: Verify bucket access
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: test "$(gh api repos/meigma/scoop-bucket --jq .full_name)" = 'meigma/scoop-bucket'