diff --git a/.github/sts/release.sts.yaml b/.github/sts/release.sts.yaml
new file mode 100644
index 0000000..c0e94b0
--- /dev/null
+++ b/.github/sts/release.sts.yaml
@@ -0,0 +1,8 @@
+# Allow the jobs that run in the release environment (Changelog Generate)
+# to mint a short-lived token to push release automation commits and open
+# or update pull requests. Replaces the release-bot GitHub App credential
+# wiring, which was never configured for this repository.
+subject: repo:tempoxyz@211589300/wallet-cli@1266776969:environment:release
+permissions:
+  contents: write
+  pull_requests: write
diff --git a/.github/workflows/changelog-generate.yml b/.github/workflows/changelog-generate.yml
index 453934f..7e6a44d 100644
--- a/.github/workflows/changelog-generate.yml
+++ b/.github/workflows/changelog-generate.yml
@@ -13,7 +13,8 @@ jobs:
     if: startsWith(github.event.label.name, 'changelog:') && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     environment: release
-    permissions: {}
+    permissions:
+      id-token: write
     steps:
       - name: Determine PR source
         id: source
@@ -41,18 +42,12 @@ jobs:
           fi
           echo "ref=$REF" >> "$GITHUB_OUTPUT"
 
-      - name: Mint scoped app token
+      - name: Fetch GitHub token via STS
         if: steps.source.outputs.same_repo == 'true'
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: tempoxyz/gh-actions/actions/github-sts@183a02178c660ce295e9a262edc5857cb7135f06
         with:
-          client-id: ${{ vars.RELEASE_BOT_APP_ID || secrets.RELEASE_BOT_APP_ID }}
-          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
-          owner: tempoxyz
-          repositories: wallet-cli
-          permission-contents: write
-          permission-pull-requests: write
-          permission-metadata: read
+          policy: release
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.source.outputs.same_repo == 'true'