diff --git a/.github/workflows/update-aws-cli-completer-scripts.yml b/.github/workflows/update-aws-cli-completer-scripts.yml
index fde3a29fc..ea6090fe9 100644
--- a/.github/workflows/update-aws-cli-completer-scripts.yml
+++ b/.github/workflows/update-aws-cli-completer-scripts.yml
@@ -9,10 +9,20 @@ jobs:
     runs-on: ubuntu-latest
     environment: documentation # grants access to secrets.PAT, for creating pull requests
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
-      - uses: actions/checkout@v7
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }}
+          private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }}
+
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Run fetch-latest-completer-scripts.sh
         run: src/aws-cli/scripts/fetch-latest-completer-scripts.sh
@@ -20,7 +30,7 @@ jobs:
       - name: Create a PR for completer scripts
         id: push_image_info
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -e
           echo "Start."
diff --git a/.github/workflows/update-documentation.yml b/.github/workflows/update-documentation.yml
index 50a643fd7..c766a6871 100644
--- a/.github/workflows/update-documentation.yml
+++ b/.github/workflows/update-documentation.yml
@@ -10,11 +10,21 @@ jobs:
     runs-on: ubuntu-latest
     environment: documentation
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     if: "github.ref == 'refs/heads/main'"
     steps:
-      - uses: actions/checkout@v7
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }}
+          private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }}
+
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Generate Documentation
         uses: devcontainers/action@v1
@@ -25,7 +35,7 @@ jobs:
       - name: Create a PR for Documentation
         id: push_image_info
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -e
           echo "Start."
diff --git a/.github/workflows/update-dotnet-install-script.yml b/.github/workflows/update-dotnet-install-script.yml
index 16f737ff2..fd2161d27 100644
--- a/.github/workflows/update-dotnet-install-script.yml
+++ b/.github/workflows/update-dotnet-install-script.yml
@@ -9,10 +9,20 @@ jobs:
     runs-on: ubuntu-latest
     environment: documentation # grants access to secrets.PAT, for creating pull requests
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
-      - uses: actions/checkout@v7
+      - name: Generate a token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.DEVCONTAINERS_REPO_AUTOMATION_ID }}
+          private-key: ${{ secrets.DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY }}
+
+      - name: Checkout
+        id: checkout
+        uses: actions/checkout@v7
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Run fetch-latest-dotnet-install.sh
         run: src/dotnet/scripts/fetch-latest-dotnet-install.sh
@@ -20,7 +30,7 @@ jobs:
       - name: Create a PR for dotnet-install.sh
         id: push_image_info
         env:
-          GITHUB_TOKEN: ${{ secrets.PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           set -e
           echo "Start."