diff --git a/.github/manifest.yaml b/.github/manifest.yaml
index 7f6ad3a7..539feb86 100644
--- a/.github/manifest.yaml
+++ b/.github/manifest.yaml
@@ -2,6 +2,7 @@ ci:
   config:
     trunk_branch: main
     state_token: ${{ secrets.CASCADE_STATE_TOKEN }}
+    release_token: ${{ secrets.CASCADE_STATE_TOKEN }}
     triggers:
       - cmd/**
       - internal/**
diff --git a/.github/workflows/orchestrate.yaml b/.github/workflows/orchestrate.yaml
index d9feebca..d76c1c56 100644
--- a/.github/workflows/orchestrate.yaml
+++ b/.github/workflows/orchestrate.yaml
@@ -46,7 +46,7 @@ jobs:
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@v0.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
           version: v0.1.0
       - name: Run Setup
         id: setup
@@ -119,12 +119,12 @@ jobs:
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@v0.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
           version: v0.1.0
       - name: Generate Changelog
         id: changelog
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
         run: |
           # Use changelog_base_sha which compares this env to next env
           # This shows commits in this env NOT yet promoted to next env
@@ -147,7 +147,7 @@ jobs:
           sha: ${{ needs.setup.outputs.head_sha }}
           changelog: ${{ steps.changelog.outputs.changelog }}
           previous_tag: ${{ needs.setup.outputs.previous_tag }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Update Manifest
         env:
           GH_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
diff --git a/.github/workflows/promote.yaml b/.github/workflows/promote.yaml
index e82ca91d..c750e842 100644
--- a/.github/workflows/promote.yaml
+++ b/.github/workflows/promote.yaml
@@ -95,7 +95,7 @@ jobs:
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@v0.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
           version: v0.1.0
       - name: Run Preflight
         id: preflight
@@ -130,7 +130,7 @@ jobs:
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@v0.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
           version: v0.1.0
       - name: Validate Promotion
         env:
@@ -157,12 +157,12 @@ jobs:
       - name: Setup CLI
         uses: stablekernel/cascade/.github/actions/setup-cli@v0.1.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
           version: v0.1.0
       - name: Generate Changelog
         id: changelog
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
           CHANGELOG_BASE_SHA: ${{ needs.preflight.outputs.changelog_base_sha }}
           SOURCE_SHA: ${{ needs.preflight.outputs.source_sha }}
         run: |
@@ -213,7 +213,7 @@ jobs:
           sha: ${{ needs.preflight.outputs.source_sha }}
           tag: ${{ needs.preflight.outputs.source_version }}
           changelog: ${{ steps.changelog.outputs.changelog }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Ensure Release Exists
         if: ${{ github.event.inputs.dry_run != 'true' && (needs.preflight.outputs.is_prerelease_env == 'true' || needs.preflight.outputs.is_final_env == 'true') }}
         uses: ./.github/actions/manage-release
@@ -224,7 +224,7 @@ jobs:
           sha: ${{ needs.preflight.outputs.source_sha }}
           tag: ${{ needs.preflight.outputs.source_version }}
           changelog: ${{ steps.changelog.outputs.changelog }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Create Prerelease
         if: ${{ github.event.inputs.dry_run != 'true' && needs.preflight.outputs.is_prerelease_env == 'true' }}
         uses: ./.github/actions/manage-release
@@ -235,13 +235,13 @@ jobs:
           sha: ${{ steps.release-data.outputs.sha }}
           tag: ${{ steps.release-data.outputs.rc_version }}
           changelog: ${{ steps.changelog.outputs.changelog }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Cleanup Orphaned Releases
         if: ${{ github.event.inputs.dry_run != 'true' && needs.preflight.outputs.skipped_envs != '' }}
         env:
           SKIPPED_ENVS: ${{ needs.preflight.outputs.skipped_envs }}
           SOURCE_VERSION: ${{ needs.preflight.outputs.source_version }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
         run: |
           IFS=',' read -ra ENVS <<< "$SKIPPED_ENVS"
           for ENV in "${ENVS[@]}"; do
@@ -264,12 +264,12 @@ jobs:
           tag: ${{ steps.release-data.outputs.sem_version }}
           delete_tag: ${{ steps.release-data.outputs.rc_version }}
           changelog: ${{ steps.changelog.outputs.changelog }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.CASCADE_STATE_TOKEN }}
       - name: Finalize Promotion
         if: ${{ github.event.inputs.dry_run != 'true' }}
         env:
           GH_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.CASCADE_STATE_TOKEN }}
           PROMOTION_RESULT: ${{ needs.preflight.outputs.promotion_result }}
         run: |
           cascade promote finalize \