diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 2d6a600b8..c84873072 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -12,9 +12,25 @@ jobs:
   release-please:
     if: github.repository == 'sentdm/sent-dm-java'
     runs-on: ubuntu-latest
+    env:
+      HAS_APP: ${{ secrets.SDK_APP_ID != '' && secrets.SDK_APP_PRIVATE_KEY != '' }}
 
     steps:
+      - name: Mint the release token from the GitHub App
+        # A tag or release created with the built-in token starts no
+        # workflow, so the publish workflow would never run; a personal
+        # access token expires or dies with its owner's account. The App's
+        # token does neither.
+        id: app
+        if: env.HAS_APP == 'true'
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v3.3.0
+        with:
+          app-id: ${{ secrets.SDK_APP_ID }}
+          private-key: ${{ secrets.SDK_APP_PRIVATE_KEY }}
+          owner: sentdm
+          repositories: ${{ github.event.repository.name }}
+
       - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
         id: release
         with:
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          token: ${{ steps.app.outputs.token || secrets.RELEASE_PLEASE_TOKEN }}