diff --git a/.github/actions/smoke-test/action.yaml b/.github/actions/smoke-test/action.yaml
index 7a9ad221ee..ee7487f38e 100644
--- a/.github/actions/smoke-test/action.yaml
+++ b/.github/actions/smoke-test/action.yaml
@@ -18,7 +18,7 @@ runs:
   steps:
     - name: Checkout main
       id: checkout_release
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
       with:
         repository: 'devcontainers/images'
         path: '__build'
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 587cfda2a8..581370c7e9 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   update_manifest_files:
     runs-on: ubuntu-latest
+    environment: publishing
     env:
       target_branch: rel/${{github.event.inputs.version}}
       version: ${{github.event.inputs.version}}
@@ -30,7 +31,7 @@ jobs:
         run: ./build/prepare-release.sh
       - name: Push manifest updates
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_AUTOMATION_PAT }}
         run: |
           git config --global user.email github-actions@github.com
           git config --global user.name github-actions
@@ -40,7 +41,7 @@ jobs:
           git push origin $target_branch
       - name: Create pull request
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ secrets.RELEASE_AUTOMATION_PAT }}
         run: |
           gh api \
                 --method POST \
diff --git a/.github/workflows/smoke-anaconda.yaml b/.github/workflows/smoke-anaconda.yaml
index 0e65f19e13..6676461501 100644
--- a/.github/workflows/smoke-anaconda.yaml
+++ b/.github/workflows/smoke-anaconda.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-base-debian.yaml b/.github/workflows/smoke-base-debian.yaml
index 0bad01a145..b34bfb6575 100644
--- a/.github/workflows/smoke-base-debian.yaml
+++ b/.github/workflows/smoke-base-debian.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-base-ubuntu.yaml b/.github/workflows/smoke-base-ubuntu.yaml
index 538a792ba8..2a9e595b48 100644
--- a/.github/workflows/smoke-base-ubuntu.yaml
+++ b/.github/workflows/smoke-base-ubuntu.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-dotnet.yaml b/.github/workflows/smoke-dotnet.yaml
index e9fdb2f10b..20e72c9896 100644
--- a/.github/workflows/smoke-dotnet.yaml
+++ b/.github/workflows/smoke-dotnet.yaml
@@ -23,8 +23,6 @@ jobs:
 
     - name: Smoke test
       id: smoke_test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       uses: ./.github/actions/smoke-test
       with:
         image: dotnet
diff --git a/.github/workflows/smoke-go.yaml b/.github/workflows/smoke-go.yaml
index 91f11a1170..aee96f7f75 100644
--- a/.github/workflows/smoke-go.yaml
+++ b/.github/workflows/smoke-go.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-java.yaml b/.github/workflows/smoke-java.yaml
index a7a2240254..259a8febdb 100644
--- a/.github/workflows/smoke-java.yaml
+++ b/.github/workflows/smoke-java.yaml
@@ -23,16 +23,12 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test java
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test_java
       uses: ./.github/actions/smoke-test
       with:
         image: java
 
     - name: Smoke test java-8
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test_java_8
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-javascript-node.yaml b/.github/workflows/smoke-javascript-node.yaml
index 119c162770..da110740af 100644
--- a/.github/workflows/smoke-javascript-node.yaml
+++ b/.github/workflows/smoke-javascript-node.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-miniconda.yaml b/.github/workflows/smoke-miniconda.yaml
index 2a1b677772..d176e3bc92 100644
--- a/.github/workflows/smoke-miniconda.yaml
+++ b/.github/workflows/smoke-miniconda.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-php.yaml b/.github/workflows/smoke-php.yaml
index f535684b95..927af23293 100644
--- a/.github/workflows/smoke-php.yaml
+++ b/.github/workflows/smoke-php.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-python.yaml b/.github/workflows/smoke-python.yaml
index 7ee236128f..604b630e08 100644
--- a/.github/workflows/smoke-python.yaml
+++ b/.github/workflows/smoke-python.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-ruby.yaml b/.github/workflows/smoke-ruby.yaml
index 233cd439ad..82a4bb83ab 100644
--- a/.github/workflows/smoke-ruby.yaml
+++ b/.github/workflows/smoke-ruby.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-rust.yaml b/.github/workflows/smoke-rust.yaml
index 5711362bb4..db7308232c 100644
--- a/.github/workflows/smoke-rust.yaml
+++ b/.github/workflows/smoke-rust.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-typescript-node.yaml b/.github/workflows/smoke-typescript-node.yaml
index de31455837..63efc66e14 100644
--- a/.github/workflows/smoke-typescript-node.yaml
+++ b/.github/workflows/smoke-typescript-node.yaml
@@ -22,8 +22,6 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Smoke test
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/smoke-universal.yaml b/.github/workflows/smoke-universal.yaml
index cb16311762..cb68c02501 100644
--- a/.github/workflows/smoke-universal.yaml
+++ b/.github/workflows/smoke-universal.yaml
@@ -20,8 +20,6 @@ jobs:
       id: checkout
       uses: actions/checkout@v6
     - name: Smoke test
-      env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       id: smoke_test
       uses: ./.github/actions/smoke-test
       with:
diff --git a/.github/workflows/version-history.yml b/.github/workflows/version-history.yml
index 98018f7230..a828dc3921 100644
--- a/.github/workflows/version-history.yml
+++ b/.github/workflows/version-history.yml
@@ -88,7 +88,7 @@ jobs:
     - name: Create PR with updated image information
       id: push_image_info
       env:
-        GITHUB_TOKEN: ${{ secrets.PAT }}
+        GITHUB_TOKEN: ${{ secrets.RELEASE_AUTOMATION_PAT }}
       run: |
         set -e