diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index ef56bd5..c6067b6 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -71,11 +71,22 @@ jobs:
           # Remove the temporary file so it is not included in the PR
           rm outdated.txt
 
+      # RELEASE_APP_ID may hold the App ID or the Client ID.
+      - name: Create GitHub App token
+        if: steps.check-outdated.outputs.has_updates == 'true' && steps.check-changes.outputs.has_changes == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Create Pull Request
         if: steps.check-outdated.outputs.has_updates == 'true' && steps.check-changes.outputs.has_changes == 'true'
         uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: 'LITE-33140: Bulk bump modules'
           branch: LITE-33140-bulk-bump-modules
           delete-branch: true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cec1fc0..970adfe 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -189,9 +189,19 @@ jobs:
         asset_path: ./connect-cli_${{ steps.tag.outputs.result }}_windows_amd64.zip
         asset_name: connect-cli_${{ steps.tag.outputs.result }}_windows_amd64.zip
         asset_content_type: application/zip
+    # RELEASE_APP_ID may hold the App ID or the Client ID.
+    - name: Create GitHub App token for Homebrew
+      id: homebrew-token
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+      with:
+        client-id: ${{ vars.RELEASE_APP_ID }}
+        private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+        owner: cloudblue
+        repositories: homebrew-connect
+        permission-actions: write
     - name: Trigger Homebrew Rebuild (CLI)
       env:
-        GH_TOKEN: ${{ secrets.PAT_HOMEBREW_CONNECT }}
+        GH_TOKEN: ${{ steps.homebrew-token.outputs.token }}
       run: |
         gh workflow run update.yml \
           --repo cloudblue/homebrew-connect \