diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e77e62c..3e92f93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,13 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          # Use a PAT so the "Version Packages" PR (and its branch pushes) are
+          # attributed to a real user and therefore trigger CI on that PR. PRs
+          # created by the default GITHUB_TOKEN never trigger workflows, which —
+          # with main's required checks + enforce_admins — would leave the release
+          # PR unmergeable. Falls back to GITHUB_TOKEN until the secret is set
+          # (then the release PR needs a manual close/reopen to get checks).
+          token: ${{ secrets.CHANGESETS_PAT || secrets.GITHUB_TOKEN }}
 
       - name: Enable Corepack
         run: corepack enable
@@ -84,6 +91,9 @@ jobs:
           title: "chore(release): version packages"
           commit: "chore(release): version packages"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # PAT (when set) so the opened Version Packages PR triggers CI; falls
+          # back to GITHUB_TOKEN. Publishing still uses OIDC (id-token), not this
+          # token — the token only authors the PR, branch pushes, tags, releases.
+          GITHUB_TOKEN: ${{ secrets.CHANGESETS_PAT || secrets.GITHUB_TOKEN }}
           # Generate npm provenance attestations from the OIDC identity.
           NPM_CONFIG_PROVENANCE: "true"