diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c382f98..5256abf 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -64,6 +64,13 @@ jobs:
       GH_REPO: ${{ github.repository }}
       TAG: ${{ github.ref_name }}
     steps:
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Download the artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -85,6 +92,10 @@ jobs:
         run: gh release create "$TAG" --verify-tag --draft --generate-notes --title "$TAG"
       - name: Upload the assets
         run: gh release upload "$TAG" dist/* --clobber
+      # GITHUB_TOKEN starts no workflow run, so the app token publishes the
+      # release and starts the tap update.
       - name: Publish the release
         if: steps.state.outputs.state != 'published'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: gh release edit "$TAG" --draft=false --latest
diff --git a/.github/workflows/update-tap.yaml b/.github/workflows/update-tap.yaml
index c189f48..bceaba0 100644
--- a/.github/workflows/update-tap.yaml
+++ b/.github/workflows/update-tap.yaml
@@ -1,7 +1,5 @@
 name: Update Tap
 on:
-  push:
-    tags: ["v*"]
   release:
     types: [published]
   workflow_dispatch:
@@ -28,18 +26,8 @@ jobs:
         env:
           EVENT_TAG: ${{ github.event.release.tag_name }}
           INPUT_TAG: ${{ inputs.tag }}
-          REF_TAG: ${{ github.ref_name }}
-          REF_TYPE: ${{ github.ref_type }}
         run: |
-          if [[ -n "$EVENT_TAG" ]]; then
-            tag="$EVENT_TAG"
-          elif [[ -n "$INPUT_TAG" ]]; then
-            tag="$INPUT_TAG"
-          elif [[ "$REF_TYPE" == "tag" ]]; then
-            tag="$REF_TAG"
-          else
-            tag=""
-          fi
+          tag="${EVENT_TAG:-$INPUT_TAG}"
           if [[ -z "$tag" ]]; then
             echo "A release tag is required." >&2
             exit 1