diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 00c5e21..fa61ea7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,6 +52,9 @@ jobs:
       !startsWith(github.event.head_commit.message, 'chore(release):')
     needs: verify
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     concurrency:
       group: release-main
       cancel-in-progress: false
@@ -114,9 +117,6 @@ jobs:
       - name: Release changed plugins
         if: steps.plan.outputs.has_releases == 'true'
         shell: bash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           while IFS= read -r plugin_id; do
             [[ -n "$plugin_id" ]] || continue
diff --git a/.github/workflows/release-plugin.yml b/.github/workflows/release-plugin.yml
index e79d505..2df9f02 100644
--- a/.github/workflows/release-plugin.yml
+++ b/.github/workflows/release-plugin.yml
@@ -33,6 +33,9 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Ensure workflow runs on default branch
         if: github.ref_name != github.event.repository.default_branch