diff --git a/gpu-dawn/.github/workflows/ci.yml b/gpu-dawn/.github/workflows/ci.yml
index 4bae10ed..a1152ed8 100644
--- a/gpu-dawn/.github/workflows/ci.yml
+++ b/gpu-dawn/.github/workflows/ci.yml
@@ -27,6 +27,8 @@ jobs:
           mv zig-out/lib/libdawn.a zig-out/lib/libdawn_x86_64-linux.a
           gzip -9 zig-out/lib/libdawn_x86_64-linux.a
           gh release upload $(git rev-parse --short HEAD) zig-out/lib/libdawn_x86_64-linux.a
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   # TODO(build-system): enable windows CI here once gpu-dawn builds under Windows
   # x86_64-windows:
   #   runs-on: windows-latest
@@ -71,3 +73,5 @@ jobs:
           mv zig-out/lib/libdawn.a zig-out/lib/libdawn_x86_64-macos.a
           gzip -9 zig-out/lib/libdawn_x86_64-macos.a
           gh release upload $(git rev-parse --short HEAD) zig-out/lib/libdawn_x86_64-macos.a
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/gpu-dawn/.github/workflows/draft_release.yml b/gpu-dawn/.github/workflows/draft_release.yml
index b05774a5..f345440b 100644
--- a/gpu-dawn/.github/workflows/draft_release.yml
+++ b/gpu-dawn/.github/workflows/draft_release.yml
@@ -9,3 +9,5 @@ jobs:
     steps:
     - name: Create draft
       run: gh release create $(git rev-parse --short HEAD) --title "Automatic release of main @ $(git rev-parse --short HEAD)"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/gpu-dawn/.github/workflows/m1_ci.yml b/gpu-dawn/.github/workflows/m1_ci.yml
index d91ef5de..01933e5e 100644
--- a/gpu-dawn/.github/workflows/m1_ci.yml
+++ b/gpu-dawn/.github/workflows/m1_ci.yml
@@ -27,3 +27,5 @@ jobs:
           mv zig-out/lib/libdawn.a zig-out/lib/libdawn_aarch64-macos.a
           gzip -9 zig-out/lib/libdawn_aarch64-macos.a
           gh release upload $(git rev-parse --short HEAD) zig-out/lib/libdawn_aarch64-macos.a
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/gpu-dawn/.github/workflows/publish_release.yml b/gpu-dawn/.github/workflows/publish_release.yml
index b6eb7dc7..1d9f790f 100644
--- a/gpu-dawn/.github/workflows/publish_release.yml
+++ b/gpu-dawn/.github/workflows/publish_release.yml
@@ -10,3 +10,5 @@ jobs:
     steps:
     - name: Publish release
       run: echo "TODO(build-system): gh CLI has no way to mark draft as published?"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}