diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e2e40f4..46fa656 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,6 +79,8 @@ jobs:
               exit 1
             }
           else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
             git tag --annotate "${tag}" --message "${tag}"
             git push origin "${tag}"
           fi
diff --git a/scripts/open-source.test.ts b/scripts/open-source.test.ts
index 2ae6169..16ea070 100644
--- a/scripts/open-source.test.ts
+++ b/scripts/open-source.test.ts
@@ -138,6 +138,8 @@ describe("open-source repository invariants", () => {
 		expect(workflow).toContain("id-token: write");
 		expect(workflow).toContain("cancel-in-progress: false");
 		expect(workflow).toContain("workflow_dispatch:");
+		expect(workflow).toContain('git config user.name "github-actions[bot]"');
+		expect(workflow).toContain("github-actions[bot]@users.noreply.github.com");
 	});
 
 	test("public worktree has no high-confidence secrets or internal machine references", () => {