diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
new file mode 100644
index 0000000000..452f3c6454
--- /dev/null
+++ b/.github/workflows/update-contributors.yml
@@ -0,0 +1,61 @@
+name: Update Contributors in README
+
+on:
+  schedule:
+    - cron: '0 0 1-7 * SUN'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  update-contributors:
+    if: github.repository == 'grafana/pyroscope'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: 'false'
+      - id: get-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@28361cdb22223e5f1e34358c86c20908e7248760
+        with:
+          repo_secrets: |
+            GITHUB_APP_ID=pyroscope-development-app:app-id
+            GITHUB_APP_INSTALLATION_ID=pyroscope-development-app:app-installation-id
+            GITHUB_APP_PRIVATE_KEY=pyroscope-development-app:private-key
+
+      - name: Generate token
+        id: generate_token
+        uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+        with:
+          app-id: ${{ env.GITHUB_APP_ID }}
+          private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            pyroscope
+      - name: Get GitHub App User ID
+        id: get-user-id
+        env:
+          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          APP_BOT="${{ steps.generate_token.outputs.app-slug }}[bot]"
+          echo "user-id=$(gh api "/users/${APP_BOT}" --jq .id)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.23.11
+      - name: Update contributors
+        run: make update-contributors
+
+      - name: Commit and push changes
+        run: |
+          APP_BOT="${{ steps.generate_token.outputs.app-slug }}[bot]"
+          git config --local user.name "${APP_BOT}"
+          git config --local user.email "${{ steps.get-user-id.outputs.user-id }}+${APP_BOT}@users.noreply.github.com"
+          if ! git diff --exit-code README.md; then
+              git add README.md
+              git commit -m 'docs: updates the list of contributors in README'
+              gh auth status
+              git push --force https://x-access-token:${{ steps.generate_token.outputs.token }}@github.com/${{ github.repository }}.git HEAD:main 2> /dev/null
+          fi
diff --git a/.github/workflows_disabled/update-contributors.yml b/.github/workflows_disabled/update-contributors.yml
deleted file mode 100644
index 36b19ccb89..0000000000
--- a/.github/workflows_disabled/update-contributors.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Update Contributors in README
-
-on:
-  schedule:
-    - cron: '0 0 1-7 * SUN'
-
-jobs:
-  update-contributors:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-      - name: Update contributors
-        run: make update-contributors
-
-      - name: Commit and push changes
-        run: |
-          git config --local user.name 'Pyroscope Bot'
-          git config --local user.email 'dmitry+bot@pyroscope.io'
-          if ! git diff --exit-code README.md; then
-              git add README.md
-              git commit -m 'docs: updates the list of contributors in README'
-              gh auth status
-              git push --force https://x-access-token:${{ secrets.BOT_GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:main 2> /dev/null
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}