diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c1849b16..36ade858 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -57,12 +57,14 @@ jobs:
     # workflow declares must be listed here — unlisted ones drop to none, and a
     # callee asking for more than the caller holds fails the run at startup.
     permissions:
+      # Mints the OIDC token npm exchanges for short-lived publish credentials.
       id-token: write
+      # Lets changesets/action push the version branch and tags.
       contents: write
+      # Lets changesets/action open the "version packages" PR.
       pull-requests: write
-    uses: repobuddy/.github/.github/workflows/pnpm-release-changeset.yml@v2
+    uses: repobuddy/.github/.github/workflows/pnpm-release-changeset-oidc.yml@v2
     needs: verify
-    secrets: inherit
 
   docgen:
     permissions: