diff --git a/.github/workflows/rust-sdk-release.yml b/.github/workflows/rust-sdk-release.yml
index 27775b6c8f..4c1d218962 100644
--- a/.github/workflows/rust-sdk-release.yml
+++ b/.github/workflows/rust-sdk-release.yml
@@ -5,17 +5,34 @@ on:
     types:
       - rust-sdk-release
 
+permissions:
+  contents: write        # allows commits/pushes
+  pull-requests: write   # allows PR creation
+
 jobs:
   create-pr:
     name: Create PR with Spin Rust Templates SDK Dependency Bump
     runs-on: ubuntu-latest
+
     steps:
+      # Checkout the repository
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: true  # uses GITHUB_TOKEN automatically
+          fetch-depth: 0
+
+      # Configure git identity for commits
+      - name: Configure git
+        run: |
+          git config user.name "spinframeworkbot"
+          git config user.email "202838904+spinframeworkbot@users.noreply.github.com"
 
+      # Run script to update the templates
       - name: Bump Rust Templates SDK Dependency
         shell: bash
         run: ./scripts/bump-rust-template-sdk.sh ${{ github.event.client_payload.version }}
 
+      # Import GPG key for signing commits
       - name: Import GPG key
         uses: crazy-max/ghaction-import-gpg@v6
         with:
@@ -24,16 +41,18 @@ jobs:
           git_user_signingkey: true
           git_commit_gpgsign: true
 
+      # Create the pull request
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v7
         with:
           commit-message: "chore(rust-templates): bump Spin Rust SDK to ${{ github.event.client_payload.version }}"
           title: "chore(rust-templates): bump Spin Rust SDK to ${{ github.event.client_payload.version }}"
-          body: Update the Spin Rust Templates SDK dependency to ${{ github.event.client_payload.version }}
+          body: |
+            Update the Spin Rust Templates SDK dependency to ${{ github.event.client_payload.version }}.
           branch: bump-spin-rust-sdk-${{ github.event.client_payload.version }}
           base: main
           delete-branch: true
           committer: spinframeworkbot <202838904+spinframeworkbot@users.noreply.github.com>
           author: spinframeworkbot <202838904+spinframeworkbot@users.noreply.github.com>
           signoff: true
-          token: ${{ secrets.PAT }}
\ No newline at end of file
+          token: ${{ github.token }}
\ No newline at end of file