diff --git a/.bumpy/_config.json b/.bumpy/_config.json
index e6867d5..f141985 100644
--- a/.bumpy/_config.json
+++ b/.bumpy/_config.json
@@ -10,7 +10,6 @@
   // narrows down which files are considered changes
   "changedFilePatterns": ["src/**", "skills/**", "package.json", "tsconfig.json", "tsdown.config.ts"],
   "publish": {
-    "provenance": true,
-    "npmStaged": true
+    "provenance": true
   }
 }
diff --git a/.bumpy/fix-draft-release-token.md b/.bumpy/fix-draft-release-token.md
new file mode 100644
index 0000000..6d2b5e1
--- /dev/null
+++ b/.bumpy/fix-draft-release-token.md
@@ -0,0 +1,5 @@
+---
+'@varlock/bumpy': patch
+---
+
+Fix draft release functions (`createDraftRelease`, `updateReleaseBody`, `finalizeRelease`, `deleteRelease`) to use `BUMPY_GH_TOKEN` via `withReleaseToken` so that GitHub release events trigger downstream workflows. Also disables npm staged publishing (not yet ready) and removes the npm upgrade step from the release workflow.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 96ee3df..cb2c442 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -23,7 +23,6 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: latest
-      - run: npm install -g npm@latest # ensure npm >= 11.15.0 for staged publishing
       - run: bun install
 
       # --- You wont need this part ---
diff --git a/packages/bumpy/src/core/github-release.ts b/packages/bumpy/src/core/github-release.ts
index 6f3dfbd..26b74ff 100644
--- a/packages/bumpy/src/core/github-release.ts
+++ b/packages/bumpy/src/core/github-release.ts
@@ -291,22 +291,22 @@ export async function createDraftRelease(
 ): Promise<void> {
   const args = ['gh', 'release', 'create', tag, '--title', title, '--notes', body, '--draft'];
   if (targetSha) args.push('--target', targetSha);
-  await runArgsAsync(args, { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(args, { cwd: rootDir }));
 }
 
 /** Update an existing GitHub release's body */
 export async function updateReleaseBody(tag: string, body: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir }));
 }
 
 /** Finalize a draft release (remove draft status) */
 export async function finalizeRelease(tag: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir }));
 }
 
 /** Delete a GitHub release */
 export async function deleteRelease(tag: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir }));
 }
 
 /** Find draft releases for a package (by name prefix) that are older than the current version */