diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 29eccf78e..7516f0502 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -10,16 +10,41 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release-please:
     name: Release Please
     runs-on: ubuntu-latest
+    environment: github-app-releaser
     timeout-minutes: 10
     steps:
+      - name: Google Cloud auth
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
+        with:
+          project_id: ${{ vars.RELEASER_PROJECT_ID }}
+          workload_identity_provider: ${{ vars.RELEASER_WORKLOAD_IDENTITY_PROVIDER }}
+
+      - name: Releaser key
+        id: releaser_key
+        uses: google-github-actions/get-secretmanager-secrets@bc9c54b29fdffb8a47776820a7d26e77b379d262 # v3.0.0
+        with:
+          secrets: |-
+            private_key:${{ vars.RELEASER_PRIVATE_KEY_SECRET }}
+
+      - name: Releaser token
+        id: releaser
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.RELEASER_APP_CLIENT_ID }}
+          private-key: ${{ steps.releaser_key.outputs.private_key }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-issues: write
+
       - name: Create release pull request or release
         uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          token: ${{ secrets.GH_PAT_RELEASE_PLEASE_ACTION }}
+          token: ${{ steps.releaser.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json