diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index efd3288..f126f84 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -29,19 +29,21 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: true
-          token: ${{ github.token }}
+          token: ${{ secrets.GH_TOKEN }}
 
       - name: Run release-please
         id: release
         uses: googleapis/release-please-action@v4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
         with:
-          token: ${{ github.token }}
+          token: ${{ secrets.GH_TOKEN }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
       - name: Synchronize checked-in release metadata
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           PR: ${{ steps.release.outputs.pr }}
         run: |
           set -euo pipefail
diff --git a/docs/release.md b/docs/release.md
index d50ad99..1e4ec06 100644
--- a/docs/release.md
+++ b/docs/release.md
@@ -137,9 +137,9 @@ before attaching them to the draft Release.
 
 ### Repository configuration
 
-Enable Actions to create and approve pull requests, and grant the default
-repository `GITHUB_TOKEN` `contents: write`, `issues: write`, and
-`pull-requests: write` for the release-please workflow. The reusable distribution workflow also needs
+Enable Actions to create and approve pull requests. The release-please workflow
+uses the repository's `GH_TOKEN` secret as `GITHUB_TOKEN` so it can create and
+update the Release PR. The reusable distribution workflow also needs
 `id-token: write` for npm provenance and `packages: write` for GitHub Packages.
 Create a protected `release` environment if publication approval is required;
 the final `publish-release` job is the only job that uses it.