diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 942ddd9..1cb5546 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -18,6 +18,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Set up Java 17
         uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
@@ -105,13 +107,17 @@ jobs:
 
       - name: Commit Release
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_PUBLISH_TOKEN: ${{ secrets.GH_PUBLISH_TOKEN }}
+          VERSION: ${{ github.event.inputs.version }}
           GIT_AUTHOR_NAME: amplitude-sdk-bot
           GIT_AUTHOR_EMAIL: amplitude-sdk-bot@users.noreply.github.com
           GIT_COMMITTER_NAME: amplitude-sdk-bot
           GIT_COMMITTER_EMAIL: amplitude-sdk-bot@users.noreply.github.com
         run: |
-          git commit -am "release: ${{ github.event.inputs.version }}"
-          git tag v${{ github.event.inputs.version }}
+          git config --local http.https://github.com/.extraheader \
+            "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GH_PUBLISH_TOKEN" | base64 -w0)"
+          git commit -am "release: ${VERSION}"
+          git tag "v${VERSION}"
           git push
           git push --tags
+          git config --local --unset-all http.https://github.com/.extraheader