diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd741479d..4f3da0043 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,9 +19,24 @@ jobs:
       contents: write # Needed for release-please to create PRs
       pull-requests: write # Needed for release-please to create PRs
     steps:
+      # Mint a GitHub App token so the release-please-created release is authored by the
+      # App, not github-actions[bot]. Events from the default GITHUB_TOKEN do NOT trigger
+      # new workflow runs (GitHub anti-recursion), which is why bot-created releases never
+      # fired `release: published` and the build/upload_pypi/deploy jobs below were skipped.
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        id: app-token
+        with:
+          app-id: ${{ secrets.DS_RELEASE_BOT_ID }}
+          private-key: ${{ secrets.DS_RELEASE_BOT_PRIVATE_KEY }}
+          # Scope the minted token to least privilege instead of inheriting the App's
+          # blanket installation permissions (zizmor: dangerous-github-app-tokens).
+          # release-please only needs Contents (tags/release) + Pull requests (release PR).
+          permission-contents: write
+          permission-pull-requests: write
+
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
 
diff --git a/RELEASING.md b/RELEASING.md
index 6de713fd8..a271d008f 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -9,7 +9,7 @@ Releases are automated via [release-please](https://github.com/googleapis/releas
    - Bumps the version in `pyproject.toml`, all sub-package `pyproject.toml` files, and `__init__.py` files
    - Bumps `appVersion` in `deployment/k8s/charts/Chart.yaml`
    - Updates `CHANGES.md` with the changelog for the new version
-3. When that PR is merged, release-please creates a GitHub release tagged `X.Y.Z`, which triggers the PyPI publish workflow.
+3. When that PR is merged, release-please creates a GitHub release tagged `X.Y.Z`. The release is authored via a **GitHub App token** (not the default `GITHUB_TOKEN`), which is what lets the `release: published` event trigger the PyPI publish and AWS deploy workflows — events from the default `GITHUB_TOKEN` do **not** cascade into new workflow runs, so a bot-authored release would otherwise publish nothing.
 
 ## Helm chart version