diff --git a/.github/actions/build-proxies/action.yml b/.github/actions/build-proxies/action.yml
index 2bbb4ee9b..fb7ad4fa7 100644
--- a/.github/actions/build-proxies/action.yml
+++ b/.github/actions/build-proxies/action.yml
@@ -97,8 +97,7 @@ runs:
 
     - name: Trigger deploy proxy
       env:
-        APP_CLIENT_ID: ${{ env.APP_CLIENT_ID }}
-        APP_PEM_FILE: ${{ env.APP_PEM_FILE }}
+        GH_TOKEN: ${{ env.GH_TOKEN }}
       shell: bash
       run: |
         .github/scripts/dispatch_internal_repo_workflow.sh \
diff --git a/.github/actions/build-sandbox/action.yml b/.github/actions/build-sandbox/action.yml
index 3f187a880..1dd7900ff 100644
--- a/.github/actions/build-sandbox/action.yml
+++ b/.github/actions/build-sandbox/action.yml
@@ -73,8 +73,7 @@ runs:
 
     - name: Trigger deploy sandbox
       env:
-        APP_CLIENT_ID: ${{ env.APP_CLIENT_ID }}
-        APP_PEM_FILE: ${{ env.APP_PEM_FILE }}
+        GH_TOKEN: ${{ env.GH_TOKEN }}
       shell: bash
       run: |
         .github/scripts/dispatch_internal_repo_workflow.sh \
diff --git a/.github/scripts/dispatch_internal_repo_workflow.sh b/.github/scripts/dispatch_internal_repo_workflow.sh
index cf51671a2..7e80addd3 100755
--- a/.github/scripts/dispatch_internal_repo_workflow.sh
+++ b/.github/scripts/dispatch_internal_repo_workflow.sh
@@ -123,64 +123,13 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-if [[ -z "$APP_PEM_FILE" ]]; then
-  echo "[ERROR] PEM_FILE environment variable is not set or is empty."
+if [[ -z "${GH_TOKEN:-}" ]]; then
+  echo "[ERROR] GH_TOKEN environment variable is not set or is empty."
   exit 1
 fi
 
-if [[ -z "$APP_CLIENT_ID" ]]; then
-  echo "[ERROR] CLIENT_ID environment variable is not set or is empty."
-  exit 1
-fi
-
-now=$(date +%s)
-iat=$((${now} - 60)) # Issues 60 seconds in the past
-exp=$((${now} + 600)) # Expires 10 minutes in the future
-
-b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; }
-
-header_json='{
-    "typ":"JWT",
-    "alg":"RS256"
-}'
-# Header encode
-header=$( echo -n "${header_json}" | b64enc )
-
-payload_json="{
-    \"iat\":${iat},
-    \"exp\":${exp},
-    \"iss\":\"${APP_CLIENT_ID}\"
-}"
-# Payload encode
-payload=$( echo -n "${payload_json}" | b64enc )
-
-# Signature
-header_payload="${header}"."${payload}"
-signature=$(
-    openssl dgst -sha256 -sign <(echo -n "${APP_PEM_FILE}") \
-    <(echo -n "${header_payload}") | b64enc
-)
-
-# Create JWT
-JWT="${header_payload}"."${signature}"
-
-INSTALLATION_ID=$(curl -X GET \
-    -H "Accept: application/vnd.github+json" \
-    -H "Authorization: Bearer ${JWT}" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    --url "https://api.github.com/app/installations" | jq -r '.[0].id')
-
-PR_TRIGGER_PAT=$(curl --request POST \
-  --url "https://api.github.com/app/installations/${INSTALLATION_ID}/access_tokens" \
-  -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${JWT}" \
-  -H "X-GitHub-Api-Version: 2022-11-28" | jq -r '.token')
-
-# Set default values if not provided
-if [[ -z "$PR_TRIGGER_PAT" ]]; then
-  echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."
-  exit 1
-fi
+# Token is minted by actions/create-github-app-token in the calling workflow
+PR_TRIGGER_PAT="$GH_TOKEN"
 
 if [[ -z "$overrides" ]]; then
   overrides=""
diff --git a/.github/workflows/deploy-dynamic-env-proxy.yaml b/.github/workflows/deploy-dynamic-env-proxy.yaml
index 1f441fbd8..c142f9e58 100644
--- a/.github/workflows/deploy-dynamic-env-proxy.yaml
+++ b/.github/workflows/deploy-dynamic-env-proxy.yaml
@@ -22,6 +22,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Install dependencies
         uses: ./.github/actions/node-install
         with:
@@ -75,8 +83,7 @@ jobs:
         env:
           PROXYGEN_API_NAME: nhs-notify-supplier
           PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         uses: ./.github/actions/build-proxies
         with:
           targetComponent: api
diff --git a/.github/workflows/deploy-supplier-api.yaml b/.github/workflows/deploy-supplier-api.yaml
index d62dcdbbc..f19b7b330 100644
--- a/.github/workflows/deploy-supplier-api.yaml
+++ b/.github/workflows/deploy-supplier-api.yaml
@@ -203,10 +203,17 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Deploy backend environment
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           bash .github/scripts/dispatch_internal_repo_workflow.sh \
             --releaseVersion "${{ needs.validate.outputs.release_version }}" \
@@ -226,6 +233,14 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Resolve nodejs version
         id: toolversions
         run: echo "nodejs_version=$(grep '^nodejs\s' .tool-versions | cut -f2 -d' ')" >>
@@ -244,8 +259,7 @@ jobs:
       - name: Deploy proxy
         env:
           PROXYGEN_API_NAME: nhs-notify-supplier
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         uses: ./.github/actions/build-proxies
         with:
           environment: ${{ needs.validate.outputs.target_environment }}
diff --git a/.github/workflows/pr_destroy_dynamic_env.yaml b/.github/workflows/pr_destroy_dynamic_env.yaml
index f5963d7d4..b1fe987d4 100644
--- a/.github/workflows/pr_destroy_dynamic_env.yaml
+++ b/.github/workflows/pr_destroy_dynamic_env.yaml
@@ -22,10 +22,17 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Trigger dynamic environment destruction
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         shell: bash
         run: |
           .github/scripts/dispatch_internal_repo_workflow.sh \
@@ -45,10 +52,17 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Trigger PR sandbox proxy destruction
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         shell: bash
         run: |
           .github/scripts/dispatch_internal_repo_workflow.sh \
@@ -62,8 +76,7 @@ jobs:
 
       - name: Trigger PR proxy destruction
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         shell: bash
         run: |
           .github/scripts/dispatch_internal_repo_workflow.sh \
diff --git a/.github/workflows/stage-3-build.yaml b/.github/workflows/stage-3-build.yaml
index e47e9e8fc..773a51512 100644
--- a/.github/workflows/stage-3-build.yaml
+++ b/.github/workflows/stage-3-build.yaml
@@ -172,10 +172,16 @@ jobs:
       - name: Set environment name
         id: set-environment
         run: echo "environment_name=${{ inputs.pr_number != '' && format('pr{0}', inputs.pr_number) || 'main' }}" >> $GITHUB_OUTPUT
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
       - name: Trigger dynamic environment creation
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
 
         shell: bash
@@ -201,10 +207,16 @@ jobs:
       - name: Set Environment Name
         id: set-environment
         run: echo "environment_name=${{ inputs.pr_number != '' && format('pr{0}', inputs.pr_number) || 'main' }}" >> $GITHUB_OUTPUT
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
       - name: "Trigger populate config workflow in internal repo"
         env:
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
         shell: bash
         run: |
@@ -225,12 +237,19 @@ jobs:
     timeout-minutes: 10
     env:
       PROXYGEN_API_NAME: nhs-notify-supplier
-      APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
-      APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
     steps:
       - name: "Checkout code"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
       - name: "Build proxies"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         uses: ./.github/actions/build-proxies
         with:
           version: "${{ inputs.version }}"
@@ -239,6 +258,8 @@ jobs:
           runId: "${{ github.run_id }}"
           releaseVersion: ${{ github.head_ref || github.ref_name }}
       - name: "Build sandbox"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         uses: ./.github/actions/build-sandbox
         with:
           version: "${{ inputs.version }}"
diff --git a/.github/workflows/stage-4-acceptance.yaml b/.github/workflows/stage-4-acceptance.yaml
index 791978dfd..5817e294a 100644
--- a/.github/workflows/stage-4-acceptance.yaml
+++ b/.github/workflows/stage-4-acceptance.yaml
@@ -66,11 +66,18 @@ jobs:
             echo "ENVIRONMENT=main" >> $GITHUB_ENV
           fi
 
+      - name: "Generate GitHub App token for nhs-notify-internal access"
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          repositories: nhs-notify-internal
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PEM_FILE }}
+
       - name: Trigger Acceptance Tests
         shell: bash
         env:
-          APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
-          APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           .github/scripts/dispatch_internal_repo_workflow.sh \