diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9b8923b..6b93c21 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,19 +7,19 @@ on:
 
 jobs:
   release:
-    name: Release
+    name: Semantic Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-      - name: Setup python version
-        uses: actions/setup-python@v7
         with:
-          python-version: "3.12"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install dependecies
-        run: uv sync --locked
+          # Full history + tags so semantic-release can determine the next version.
+          fetch-depth: 0
+          # Must be false: otherwise checkout stores the default GITHUB_TOKEN as a git
+          # auth header and the release push would use it (github-actions[bot], which is
+          # NOT on main's bypass list → GH006). With no persisted credentials, the push
+          # uses the SEMANTIC_RELEASE_GH_TOKEN below instead.
+          persist-credentials: false
       - name: Semantic Release
         uses: cycjimmy/semantic-release-action@v6
         with:
@@ -27,4 +27,6 @@ jobs:
             @semantic-release/exec
             @semantic-release/git
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Repo-scoped token whose identity bypasses PR protection on main, so the
+          # @semantic-release/git version-bump commit can be pushed to the protected branch.
+          GITHUB_TOKEN: ${{ secrets.SEMANTIC_RELEASE_GH_TOKEN }}