diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1a983553..59d710c96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,11 +35,17 @@ jobs:
   publish:
     if: ${{ github.ref == 'refs/heads/main' && github.event.inputs.release == 'release' }}
     runs-on: ubuntu-latest
+    # semantic-release pushes the release commit and tag, and labels and comments on released issues and PRs
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
+          # Keep the token out of .git/config, semantic-release adds it to the push URL itself
+          persist-credentials: false
 
       - name: 🏗 Setup runner
         uses: ./.github/actions/setup
@@ -50,7 +56,7 @@ jobs:
       - name: 📋 Release code
         run: bun semantic-release
         env:
-          GITHUB_TOKEN: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           GIT_AUTHOR_NAME: Expo CI
           GIT_AUTHOR_EMAIL: support+ci@expo.dev
           GIT_COMMITTER_NAME: Expo CI
@@ -59,33 +65,18 @@ jobs:
   tags:
     needs: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: 🏗 Setup repo
         uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.EXPOBOT_GITHUB_TOKEN }}
-
-      - name: 🏗 Setup runner
-        uses: ./.github/actions/setup
 
       - name: 👷 Force repo to latest
         run: git fetch --all && git pull
 
-      - name: 📦 Install dependencies
-        run: bun install
-
-      - name: 📦 Install semver
-        run: bun add --dev semver
-
       - name: 🕵️ Resolve major version
-        uses: actions/github-script@v7
         id: version
-        with:
-          result-encoding: string
-          script: |
-            const semver = require('semver')
-            const { version } = require('./package.json')
-            return semver.major(version)
+        run: echo "major=$(node -p "require('./package.json').version.split('.')[0]")" >> "$GITHUB_OUTPUT"
 
       - name: 👷 Configure git
         run: |
@@ -96,4 +87,6 @@ jobs:
         run: git clean . -xdf && git reset --hard HEAD && git pull && git fetch --tags
 
       - name: 📋 Update tags
-        run: git tag --force v${{ steps.version.outputs.result }} && git push --force --tags
+        run: git tag --force "v$MAJOR" && git push --force origin "v$MAJOR"
+        env:
+          MAJOR: ${{ steps.version.outputs.major }}