diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index ba12e01..53257b6 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false # tag push below supplies the token explicitly
 
       - name: Read version from package.json
         id: version
@@ -125,13 +126,16 @@ jobs:
       - name: Create annotated tag
         if: steps.gate.outputs.skip != 'true' && steps.bumped.outputs.skip != 'true'
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ steps.version.outputs.tag }}
         run: |
           set -euo pipefail
           git config user.name 'askalf'
           git config user.email 'support@askalf.org'
           git tag -a "$TAG" -m "Release $TAG"
-          git push origin "$TAG"
+          # Push with an explicit token so it never lands in .git/config during the
+          # install+test step above (checkout runs persist-credentials: false).
+          git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "$TAG"
 
       - name: Create GitHub release
         if: steps.gate.outputs.skip != 'true' && steps.bumped.outputs.skip != 'true'