diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index f10a232..5d077fd 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -22,6 +22,16 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
+      - name: Create Operator Stack Publisher token
+        id: publisher-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.OPERATOR_STACK_PUBLISHER_APP_CLIENT_ID || vars.BOATSTACK_APP_CLIENT_ID }}
+          private-key: ${{ secrets.OPERATOR_STACK_PUBLISHER_APP_PRIVATE_KEY || secrets.BOATSTACK_APP_PRIVATE_KEY }}
+          owner: operatorstack
+          repositories: value-map
+          permission-contents: read
+          permission-pull-requests: write
       - name: Check out Value Map
         uses: actions/checkout@v4
         with:
@@ -49,7 +59,7 @@ jobs:
           echo "source_commit=$source_commit" >> "$GITHUB_OUTPUT"
       - name: Open generated pull request
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.publisher-token.outputs.token }}
           SOURCE_COMMIT: ${{ steps.project.outputs.source_commit }}
         shell: bash
         run: |
diff --git a/tests/test_distribution.py b/tests/test_distribution.py
index 0176eec..ee4831b 100644
--- a/tests/test_distribution.py
+++ b/tests/test_distribution.py
@@ -102,6 +102,9 @@ def test_sync_accepts_exact_publisher_dispatch_with_polling_fallback(self) -> No
         self.assertIn("Operator Stack Publisher", workflow)
         self.assertIn("inputs.source_commit || 'main'", workflow)
         self.assertIn('cron: "23 */6 * * *"', workflow)
+        self.assertIn("actions/create-github-app-token@v3", workflow)
+        self.assertIn("steps.publisher-token.outputs.token", workflow)
+        self.assertNotIn("GH_TOKEN: ${{ github.token }}", workflow)
 
 
 if __name__ == "__main__":