diff --git a/.github/workflows/create-tag.yml b/.github/workflows/create-tag.yml
index d909019..5e8631e 100644
--- a/.github/workflows/create-tag.yml
+++ b/.github/workflows/create-tag.yml
@@ -9,7 +9,7 @@ on:
       - main
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   tag:
@@ -19,6 +19,11 @@ jobs:
       with:
         fetch-depth: 0 # also fetch tags
 
+    - uses: elastic/apm-pipeline-library/.github/actions/setup-git@current
+      with:
+        # This should help with running GitHub events
+        token: ${{ secrets.CREATE_TAG_TOKEN }}
+
     - uses: actions/setup-go@v5
       with:
         go-version-file: go.mod