diff --git a/.github/workflows/bump.yaml b/.github/workflows/bump.yaml
index 7af6a17..7d0570c 100644
--- a/.github/workflows/bump.yaml
+++ b/.github/workflows/bump.yaml
@@ -13,6 +13,7 @@ permissions: {}
 jobs:
   bump:
     runs-on: ubuntu-latest
+    environment: personal-token
     permissions:
       contents: write
       pull-requests: write
@@ -46,14 +47,19 @@ jobs:
             exit 0
           fi
           git commit -am "bump deps"
-      - name: Open a PR
+      - name: Push branch with elevated permissions
         env:
           VERSION: ${{ inputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.DWILDING_GITHUB_TOKEN }}  # Needs scope "Update GitHub Action workflows".
         run: |
           set -euo pipefail
           git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push --force origin "bump-to-$VERSION"
+      - name: Open a PR
+        env:
+          VERSION: ${{ inputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
           gh pr create --base main --head "bump-to-$VERSION" \
             --title "chore: bump package to $VERSION" \
             --body "" \