diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 37f88c52..e161f0d5 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -14,7 +14,8 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     permissions:
-      contents: write   # only used by the post-merge baseline refresh step below
+      contents: write        # push the baseline branch for the post-merge PR below
+      pull-requests: write   # open the post-merge baseline-refresh PR
 
     steps:
       - uses: actions/checkout@v4
@@ -66,31 +67,16 @@ jobs:
       - name: Quality gate
         run: ./scripts/quality-gate/gate.sh packages ${{ github.event_name == 'pull_request' && '--bypass-format' || '--overwrite-baseline' }}
 
-      # Commit the new baseline back to master. always() so an improvement still
-      # lands even if a later stage failed — a coverage/warning gain is orthogonal to,
-      # say, a flaky E2E. Only runs on push (PRs are read-only, nothing to commit).
-      #
-      # format-master.yml fires on the same merge and also pushes to master, so this
-      # push can lose a race; fetch+rebase+retry rather than clobber. The push uses the
-      # default GITHUB_TOKEN, whose pushes don't trigger another workflow run, so this
-      # can't loop back into itself.
       - name: Refresh baseline on master
         if: always() && github.event_name == 'push'
-        run: |
-          if ! git status --porcelain -- 'packages/*/.gate-baseline.json' | grep -q .; then
-            echo "no baseline change"
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -- 'packages/*/.gate-baseline.json'
-          git commit -m "chore(quality-gate): refresh baseline after merge"
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:master; then exit 0; fi
-            echo "push rejected (attempt $attempt) — rebasing onto latest master and retrying"
-            git fetch origin master
-            git rebase origin/master || { git rebase --abort; exit 1; }
-          done
-          echo "could not push baseline after retries" >&2
-          exit 1
+        uses: peter-evans/create-pull-request@v7
+        with:
+          add-paths: packages/*/.gate-baseline.json
+          base: master
+          branch: automation/refresh-baseline
+          delete-branch: true
+          commit-message: "chore(quality-gate): refresh baseline after merge"
+          title: "chore(quality-gate): refresh baseline after merge"
+          body: |
+            Refreshes the quality-gate baseline after a merge to master.
 
diff --git a/.github/workflows/format-master.yml b/.github/workflows/format-master.yml
index 772706dc..0a1b6e26 100644
--- a/.github/workflows/format-master.yml
+++ b/.github/workflows/format-master.yml
@@ -18,7 +18,8 @@ jobs:
     if: github.event.head_commit.author.email != 'github-actions[bot]@users.noreply.github.com'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write        # push the format branch for the PR below
+      pull-requests: write   # open the auto-format PR
 
     steps:
       - uses: actions/checkout@v4
@@ -42,14 +43,14 @@ jobs:
           fi
           ./scripts/quality-gate/format-suggest.sh packages --base-ref "$before"
 
-      - name: Commit and push if anything changed
-        run: |
-          if git status --porcelain -- '*.cs' | grep -q .; then
-            git config user.name "github-actions[bot]"
-            git config user.email "github-actions[bot]@users.noreply.github.com"
-            git add -- '*.cs'
-            git commit -m "chore(format): auto-format after merge"
-            git push origin HEAD:master
-          else
-            echo "nothing to format"
-          fi
+      - name: Open PR with formatting fix
+        uses: peter-evans/create-pull-request@v7
+        with:
+          add-paths: "*.cs"
+          base: master
+          branch: automation/format-master
+          delete-branch: true
+          commit-message: "chore(format): auto-format after merge"
+          title: "chore(format): auto-format after merge"
+          body: |
+            Applies `dotnet format` to files changed by the last merge to master.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cefe0654..f5b0d942 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
 
   publish:
     needs: release-please
-    if: ${{ github.repository_owner == 'supabase-community' && (needs.release-please.outputs.releases_created == 'true'|| github.event_name == 'workflow_dispatch') }}
+    if: ${{ github.repository_owner == 'supabase' && (needs.release-please.outputs.releases_created == 'true'|| github.event_name == 'workflow_dispatch') }}
     name: build, pack & publish
     runs-on: ubuntu-latest
     permissions:
@@ -68,11 +68,12 @@ jobs:
 
   mark-api-shipped:
     needs: [release-please, publish]
-    if: ${{ github.repository_owner == 'supabase-community' && (needs.release-please.outputs.releases_created == 'true'|| github.event_name == 'workflow_dispatch') }}
+    if: ${{ github.repository_owner == 'supabase' && (needs.release-please.outputs.releases_created == 'true'|| github.event_name == 'workflow_dispatch') }}
     name: mark public API shipped
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -81,21 +82,14 @@ jobs:
       - name: Fold Unshipped API into Shipped
         run: ./scripts/quality-gate/mark-api-shipped.sh packages
 
-      - name: Commit shipped API to master
-        run: |
-          if ! git status --porcelain -- 'packages/*/PublicAPI.*.txt' | grep -q .; then
-            echo "no public API to ship"
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add -- 'packages/*/PublicAPI.*.txt'
-          git commit -m "chore(quality-gate): mark public API shipped after release"
-          for attempt in 1 2 3 4 5; do
-            if git push origin HEAD:master; then exit 0; fi
-            echo "push rejected (attempt $attempt) — rebasing onto latest master and retrying"
-            git fetch origin master
-            git rebase origin/master || { git rebase --abort; exit 1; }
-          done
-          echo "could not push shipped API after retries" >&2
-          exit 1
+      - name: Open PR to mark shipped API
+        uses: peter-evans/create-pull-request@v7
+        with:
+          add-paths: packages/*/PublicAPI.*.txt
+          base: master
+          branch: automation/mark-api-shipped
+          delete-branch: true
+          commit-message: "chore(quality-gate): mark public API shipped after release"
+          title: "chore(quality-gate): mark public API shipped after release"
+          body: |
+            Folds Unshipped public API into Shipped after release ${{ needs.release-please.outputs.tag_name }}.