diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 6476ff8..e15fc68 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -3,9 +3,12 @@
 # Merging the Release PR writes the CHANGELOG entry and the manifest version; the next run tags the merge commit and
 # creates the GitHub release. Tags are bare versions (0.9.1), never moved.
 #
-# A PR opened with GITHUB_TOKEN starts no workflows, so this job dispatches CI on the Release PR's branch: the required
-# `test` check then reports on its head commit. Step env is evaluated even when `if` skips the step, so the PR JSON is
-# read with jq rather than fromJSON (empty on a run with no Release PR). Needs "Allow GitHub Actions to create and approve pull requests".
+# The org's release app opens the Release PR and pushes the tag (org variable RELEASE_APP_CLIENT_ID, org secret RELEASE_APP_KEY):
+# a PR opened with GITHUB_TOKEN gets pull_request runs that wait for a maintainer's approval, and its tags start no
+# workflows. With the app token CI runs on the Release PR like on any PR, and the tag runs the tag workflows.
+# Without the app (variable unset) the job falls back to GITHUB_TOKEN and dispatches CI on the Release PR's branch. Step
+# env is evaluated even when `if` skips the step, so the PR JSON is read with jq rather than fromJSON (empty on a run with
+# no Release PR). Needs "Allow GitHub Actions to create and approve pull requests".
 name: release-please
 
 on:
@@ -26,13 +29,20 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
+      - id: app
+        if: vars.RELEASE_APP_CLIENT_ID != ''
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_KEY }}
       - id: release
         uses: googleapis/release-please-action@v4
         with:
+          token: ${{ steps.app.outputs.token || github.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
       - name: Run CI on the Release PR
-        if: steps.release.outputs.pr
+        if: steps.release.outputs.pr && steps.app.outputs.token == ''
         run: gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$(jq -r .headBranchName <<<"$PR")"
         env:
           PR: ${{ steps.release.outputs.pr }}