diff --git a/.github/workflows/refresh-upstream.yml b/.github/workflows/refresh-upstream.yml
index 065a864..82f32b1 100644
--- a/.github/workflows/refresh-upstream.yml
+++ b/.github/workflows/refresh-upstream.yml
@@ -20,6 +20,32 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: Validate GitHub App configuration
+        env:
+          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+        run: |
+          if [ -z "$WORKFLOW_APP_ID" ]; then
+            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
+            exit 1
+          fi
+          if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
+            echo "::error::LIBRECODE_WORKFLOW_APP_PRIVATE_KEY is not configured."
+            exit 1
+          fi
+
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+          owner: LibreCodeCoop
+          repositories: github-workflows
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
+
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -57,7 +83,7 @@ jobs:
         if: steps.refresh.outcome == 'success'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          token: ${{ secrets.WORKFLOW_UPDATE_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: 'chore: refresh upstream workflow pins'
           committer: GitHub <noreply@github.com>
           author: github-workflows bot <noreply@github.com>
@@ -72,6 +98,7 @@ jobs:
             upstream/sources.json
             upstream/vendor/**
             workflow-templates/**
+            .github/workflows/**
 
       - name: Fail when patches need manual updates
         if: steps.render.outcome == 'failure'