diff --git a/.github/workflows/automated-release.yml b/.github/workflows/automated-release.yml
index cd8f11b6..9d105f51 100644
--- a/.github/workflows/automated-release.yml
+++ b/.github/workflows/automated-release.yml
@@ -60,6 +60,9 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       bump: ${{ steps.bump.outputs.bump }}
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -74,7 +77,7 @@ jobs:
       - name: Determine bump type from PR labels
         id: bump
         env:
-          GH_TOKEN: ${{ secrets.PRO_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_TOKEN_RELEASE }}
         run: |
           set -euo pipefail
 
@@ -127,13 +130,16 @@ jobs:
     needs: [check-changes, determine-bump, ci]
     if: needs.check-changes.outputs.has_changes == 'true'
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code # zizmor: ignore[artipacked] the tag push needs it; this job uploads no artifacts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Fetch tags
         run: git fetch --tags --force
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac4b3f3c..c0e6ec3b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -388,6 +388,9 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: write
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -457,7 +460,7 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_TOKEN: ${{ secrets.PRO_ACCESS_TOKEN }}
+          HOMEBREW_TAP_TOKEN: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Set up Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
diff --git a/.github/workflows/create-release-tag.yml b/.github/workflows/create-release-tag.yml
index 53493f3a..07528fd4 100644
--- a/.github/workflows/create-release-tag.yml
+++ b/.github/workflows/create-release-tag.yml
@@ -15,7 +15,7 @@ on:
           - patch
           - minor
 
-# The tag push authenticates with PRO_ACCESS_TOKEN, not GITHUB_TOKEN.
+# The tag push authenticates with GH_TOKEN_RELEASE, not GITHUB_TOKEN.
 permissions:
   contents: read
 
@@ -29,13 +29,16 @@ jobs:
     # Pushes a tag, which triggers the publishing workflows.
     if: github.repository == 'localstack/lstk'
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      deployment: false
     steps:
       - name: Checkout code # zizmor: ignore[artipacked] the tag push needs it; this job uploads no artifacts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.release_ref }}
           fetch-depth: 0
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_RELEASE }}
 
       - name: Fetch tags
         run: git fetch --tags --force
diff --git a/.github/workflows/weekly-go-upgrade.yml b/.github/workflows/weekly-go-upgrade.yml
index 589356fb..5b521b31 100644
--- a/.github/workflows/weekly-go-upgrade.yml
+++ b/.github/workflows/weekly-go-upgrade.yml
@@ -5,7 +5,7 @@ on:
     - cron: "0 8 * * 1"
   workflow_dispatch:
 
-# create-pull-request pushes and opens the PR with PRO_ACCESS_TOKEN.
+# create-pull-request pushes and opens the PR with GH_TOKEN_OPEN_NEW_PR.
 permissions: {}
 
 jobs:
@@ -49,4 +49,4 @@ jobs:
             dependencies
             semver: patch
             docs: skip
-          token: ${{ secrets.PRO_ACCESS_TOKEN }}
+          token: ${{ secrets.GH_TOKEN_OPEN_NEW_PR }}