diff --git a/.ci/updatecli/values.d/scm.yml b/.ci/updatecli/values.d/scm.yml
index 16262012d..0163a8fae 100644
--- a/.ci/updatecli/values.d/scm.yml
+++ b/.ci/updatecli/values.d/scm.yml
@@ -5,6 +5,6 @@ scm:
   branch: main
   commitusingapi: true
   # begin update-compose policy values
-  user: obltmachine
-  email: obltmachine@users.noreply.github.com
+  user: 'github-actions[bot]'
+  email: '41898282+github-actions[bot]@users.noreply.github.com'
   # end update-compose policy values
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
index 98d6e98f9..34f6b27c6 100644
--- a/.github/workflows/updatecli.yml
+++ b/.github/workflows/updatecli.yml
@@ -13,21 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
       packages: read
     steps:
       - uses: actions/checkout@v7
 
+      # TokenPolicy defined at https://github.com/elastic/catalog-info/tree/main/resources/github-token-policies/token-policy-apm-agent-ruby-updatecli.yaml
       - name: Get token
         id: get_token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.OBS_AUTOMATION_APP_ID }}
-          private-key: ${{ secrets.OBS_AUTOMATION_APP_PEM }}
-          permission-contents: write
-          permission-pull-requests: write
-          permission-members: read
-          repositories:
-            apm-agent-ruby
+        uses: elastic/oblt-actions/github/create-token@v1
+
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io