diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index c0555a40..5dccaf88 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -83,7 +83,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.PROJECT_TOKEN }}
 
       # Step 5: Figure out what tags to use
       - name: 🏷️ Extract metadata (tags, labels)
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 2cfe2668..a25a11dc 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -73,7 +73,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.PROJECT_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         if: steps.skip.outputs.skip_build != 'true'
diff --git a/.github/workflows/propagate-changes.yml b/.github/workflows/propagate-changes.yml
index 01e4705e..857e545f 100644
--- a/.github/workflows/propagate-changes.yml
+++ b/.github/workflows/propagate-changes.yml
@@ -89,6 +89,6 @@ jobs:
 
             core.info(`Created PR #${pr.data.number}: ${pr.data.html_url}`);
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
           SOURCE_BRANCH: ${{ steps.branches.outputs.source }}
           TARGET_BRANCH: ${{ steps.branches.outputs.target }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0ba65c12..88d4baf5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
           draft: false
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') || contains(github.ref_name, 'rc') }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PROJECT_TOKEN }}
 
   build-and-publish:
     needs: create-release
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index c02e975a..6463e658 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -22,6 +22,6 @@ jobs:
         uses: renovatebot/github-action@v40.1.11
         with:
           configurationFile: .github/renovate.json
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.PROJECT_TOKEN }}
         env:
           LOG_LEVEL: info