diff --git a/.github/workflows/pull-request-helper.yml b/.github/workflows/pull-request-helper.yml
index c1dee3a9f3..b3b9b969ae 100644
--- a/.github/workflows/pull-request-helper.yml
+++ b/.github/workflows/pull-request-helper.yml
@@ -10,11 +10,18 @@ jobs:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.AI_JAVA_HELPER_APP_CLIENT_ID }}
+          private-key: ${{ secrets.AI_JAVA_HELPER_APP_PRIVATE_KEY }}
+          permission-contents: write
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # this is the personal access token used for "git push" below
-          # which is needed in order to trigger workflows
-          token: ${{ secrets.PR_HELPER_GITHUB_TOKEN }}
+          # an app token is used (instead of GITHUB_TOKEN) so that "git push" below triggers workflows
+          token: ${{ steps.app-token.outputs.token }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
 
@@ -61,7 +68,5 @@ jobs:
           git commit -m "./gradlew resolveAndLockAll --write-locks"
 
       - name: Push
-        env:
-          GH_TOKEN: ${{ github.token }}
         run: |
           git push