diff --git a/.github/workflows/cut_new_release_candidate.yml b/.github/workflows/cut_new_release_candidate.yml
index 5b73d170e9b..d7616e35d51 100644
--- a/.github/workflows/cut_new_release_candidate.yml
+++ b/.github/workflows/cut_new_release_candidate.yml
@@ -46,11 +46,19 @@ jobs:
     needs:
       - create_release_candidate
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token
     steps:
+      - name: Mint channel-versions token
+        id: app_token
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        with:
+          scope: warpdotdev/channel-versions
+          identity: warp-internal-dispatch
       - name: Invoke update workflow in channel-versions repository
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           repository: warpdotdev/channel-versions
-          token: ${{ secrets.CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           event-type: update-channel-versions
     
diff --git a/.github/workflows/cut_new_releases.yml b/.github/workflows/cut_new_releases.yml
index 9f5299f3fb9..6e720e69a9a 100644
--- a/.github/workflows/cut_new_releases.yml
+++ b/.github/workflows/cut_new_releases.yml
@@ -87,10 +87,18 @@ jobs:
     needs:
       - create_release
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token
     steps:
+      - name: Mint channel-versions token
+        id: app_token
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        with:
+          scope: warpdotdev/channel-versions
+          identity: warp-internal-dispatch
       - name: Invoke update workflow in channel-versions repository
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           repository: warpdotdev/channel-versions
-          token: ${{ secrets.CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           event-type: update-channel-versions
diff --git a/.github/workflows/notify-docs-settings-changed.yml b/.github/workflows/notify-docs-settings-changed.yml
index 8e64f28be6e..99a757ea8bf 100644
--- a/.github/workflows/notify-docs-settings-changed.yml
+++ b/.github/workflows/notify-docs-settings-changed.yml
@@ -2,6 +2,7 @@ name: Notify docs of Settings UI changes
 
 # Fires when any Settings view source file is merged to master, signalling
 # that valid_paths.json in warpdotdev/docs may need to be refreshed.
+# The dispatch runs only in warp-internal; the synced copy in public warp skips it.
 #
 # If this job fails:
 #   1. GitHub will email the commit author automatically.
@@ -23,14 +24,24 @@ permissions: {}
 jobs:
   dispatch:
     name: Dispatch settings-ui-changed to docs
+    if: github.repository == 'warpdotdev/warp-internal'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write # octo-sts/action exchanges the job's OIDC token for a scoped GitHub token
     steps:
+      - name: Mint docs token
+        id: app_token
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
+        with:
+          scope: warpdotdev/docs
+          identity: warp-internal-dispatch
+
       - name: Send repository_dispatch to warpdotdev/docs
         id: dispatch
         uses: peter-evans/repository-dispatch@v4
         with:
           repository: warpdotdev/docs
-          token: ${{ secrets.DOCS_REPOSITORY_DISPATCH_TOKEN }}
+          token: ${{ steps.app_token.outputs.token }}
           event-type: settings-ui-changed
           client-payload: |
             {