diff --git a/.github/workflows/shared-go-auto-release.yml b/.github/workflows/shared-go-auto-release.yml
index 78bc991e..cd00b23b 100644
--- a/.github/workflows/shared-go-auto-release.yml
+++ b/.github/workflows/shared-go-auto-release.yml
@@ -243,6 +243,26 @@ jobs:
           df -h
 
 
+      # Re-minted immediately before the long-running goreleaser invocation:
+      # GitHub App installation tokens are hard-capped at 1 hour (not
+      # configurable), and the goreleaser step below (build + sign + SBOM +
+      # publish, across every platform target) has been taking 45-65+
+      # minutes on its own and trending upward. The original `github-app`
+      # token from the top of this job has already burned several minutes on
+      # setup (git/gpg install, harden-runner init, syft install, checkout,
+      # unshallow, go setup, gpg import, disk-space checks, apt cleanup)
+      # before goreleaser even starts, so by the time goreleaser reaches its
+      # final publish-phase API calls (listing/deleting existing drafts) the
+      # original token can already be expired, failing with a `401 Bad
+      # credentials` that has nothing to do with the release content itself.
+      # Minting a fresh token right here maximizes the runway goreleaser gets
+      # before its own token goes stale.
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: github-app-release
+        with:
+          app-id: ${{ vars.BOT_GITHUB_APP_ID }}
+          private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         id: releaser
@@ -252,7 +272,7 @@ jobs:
           args: release --config ${{ steps.go-releaser-config.outputs.path }} --clean --timeout 180m
         env:
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
-          GITHUB_TOKEN: ${{ steps.github-app.outputs.token }}
+          GITHUB_TOKEN: ${{ steps.github-app-release.outputs.token }}
           GO_RELEASER_TARGET_COMMITISH: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
           GO_RELEASER_DRAFT_MODE: ${{ inputs.draft }}
 
@@ -264,7 +284,7 @@ jobs:
       - name: "Attest build provenance"
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
-          github-token: ${{ steps.github-app.outputs.token }}
+          github-token: ${{ steps.github-app-release.outputs.token }}
           subject-path: 'source/dist/*'
 
       - name: "Resolve checksums file"