diff --git a/.github/workflows/sync-vpm-yanks.yml b/.github/workflows/sync-vpm-yanks.yml
index 1a1edd4..e34dfaf 100644
--- a/.github/workflows/sync-vpm-yanks.yml
+++ b/.github/workflows/sync-vpm-yanks.yml
@@ -21,7 +21,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: vpm-repository-update
@@ -45,10 +45,30 @@ jobs:
           echo "VPM repository default branch must be master."
           exit 1
 
+      - name: Create VPM repository GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+
+      - name: Resolve GitHub App bot identity
+        id: app-bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          bot_login="${APP_SLUG}[bot]"
+          bot_id="$(gh api "users/${bot_login}" --jq '.id')"
+          echo "name=${bot_login}" >> "$GITHUB_OUTPUT"
+          echo "email=${bot_id}+${bot_login}@users.noreply.github.com" >> "$GITHUB_OUTPUT"
+
       - name: Checkout VPM repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
+          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
       - name: Set up Python 3.12
@@ -80,9 +100,12 @@ jobs:
 
       - name: Commit and push yank projection
         if: steps.sync.outputs.changed == 'true'
+        env:
+          APP_BOT_NAME: ${{ steps.app-bot.outputs.name }}
+          APP_BOT_EMAIL: ${{ steps.app-bot.outputs.email }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "$APP_BOT_NAME"
+          git config user.email "$APP_BOT_EMAIL"
           git add -- vpm.json
           git commit -m "Sync ${PACKAGE_NAME} yank policy"
           git push origin "HEAD:master"
diff --git a/.github/workflows/update-vpm.yml b/.github/workflows/update-vpm.yml
index 8588c59..18cf631 100644
--- a/.github/workflows/update-vpm.yml
+++ b/.github/workflows/update-vpm.yml
@@ -41,7 +41,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: vpm-repository-update
@@ -72,10 +72,30 @@ jobs:
           echo "VPM repository default branch must be master."
           exit 1
 
+      - name: Create VPM repository GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+
+      - name: Resolve GitHub App bot identity
+        id: app-bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          bot_login="${APP_SLUG}[bot]"
+          bot_id="$(gh api "users/${bot_login}" --jq '.id')"
+          echo "name=${bot_login}" >> "$GITHUB_OUTPUT"
+          echo "email=${bot_id}+${bot_login}@users.noreply.github.com" >> "$GITHUB_OUTPUT"
+
       - name: Checkout VPM repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
+          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
       - name: Set up Python 3.12
@@ -94,9 +114,12 @@ jobs:
 
       - name: Commit and push listing
         if: steps.update.outputs.changed == 'true'
+        env:
+          APP_BOT_NAME: ${{ steps.app-bot.outputs.name }}
+          APP_BOT_EMAIL: ${{ steps.app-bot.outputs.email }}
         run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "$APP_BOT_NAME"
+          git config user.email "$APP_BOT_EMAIL"
           git add -- vpm.json
           git commit -m "Add ${PACKAGE_NAME} ${VERSION}"
           git push origin "HEAD:master"
diff --git a/README.md b/README.md
index 195dc3e..1d55255 100644
--- a/README.md
+++ b/README.md
@@ -42,15 +42,17 @@ For each Pure Base version, generated links use:
 
 This keeps historical metadata stable even if the default branch changes later.
 
-## Required Pure Base configuration
+## Required GitHub App configuration
 
-Configure the following in `Penguin-Repository/Pure-Base`:
+Configure the following in both `Penguin-Repository/Pure-Base` and `Penguin-Repository/VPM-Repository`:
 
-- Repository variable `VPM_REPOSITORY`: `Penguin-Repository/VPM-Repository`
-- Release-environment secrets `APP_CLIENT_ID` and `APP_PRIVATE_KEY`
-- A GitHub App installation that can write contents in both repositories
+- Repository secrets `APP_CLIENT_ID` and `APP_PRIVATE_KEY`
+- A GitHub App installation covering both repositories
+- GitHub App repository permission `Contents: Read and write`
 
-The receiving workflow uses its scoped `GITHUB_TOKEN` with `contents: write`; it does not need copies of the GitHub App private key.
+Configure repository variable `VPM_REPOSITORY` in `Penguin-Repository/Pure-Base` as `Penguin-Repository/VPM-Repository`.
+
+The receiving workflows create a repository-scoped installation token with `contents: write`, use it for checkout and direct pushes to `master`, and commit as the GitHub App bot using its ID-based GitHub noreply address. The workflow-level `GITHUB_TOKEN` remains read-only and is used only for validation requests.
 
 ## Dispatch payload