diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e7c7660..feb95e3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,6 +22,13 @@ jobs:
       # pnpm is not pre-installed on ubuntu-latest runners; Volta manages node only.
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
+        with:
+          version: 11.19.0
+
+      # pnpm 11 ignores credentials from a project-level .npmrc. Store the
+      # GitHub Packages token in the trusted user config before publishing.
+      - name: Configure GitHub Packages authentication
+        run: pnpm config set '//npm.pkg.github.com/:_authToken' "$GH_NPM_TOKEN"
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index f973ae0..6730183 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,8 +13,15 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
+      - name: Generate release app token
+        id: release-app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.CASE_CI_RELEASE_APP_ID }}
+          private-key: ${{ secrets.CASE_CI_RELEASE_APP_PRI_KEY }}
+
       - name: Create Release PR
         uses: googleapis/release-please-action@v4
         with:
           release-type: node
-          token: ${{ secrets.PAT }}
+          token: ${{ steps.release-app-token.outputs.token }}