diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f0e899e4b..f7361ad6c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,30 +8,51 @@ on:
     paths:
       - 'website/**'
 
+env:
+  GIT_CI_USER: ${{ vars.GIT_CI_USER || 'prestodb-ci' }}
+  GIT_CI_EMAIL: ${{ vars.GIT_CI_EMAIL || 'ci@lists.prestodb.io' }}
+
 jobs:
   checks:
     if: github.event_name != 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v6
         with:
-          node-version: '18.x'
+          show-progress: false
+          persist-credentials: false
+      - uses: actions/setup-node@v4
       - name: Test Build
         run: cd website && yarn install && yarn build
+
   gh-release:
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v6
         with:
-          node-version: '18.x'
-      - name: Git config
-        run: git config --global user.email "presto-oss@users.noreply.github.com" && git config --global user.name "Presto Bot"
-      - name: Fetch credentials
-        run: echo "machine github.com login presto-oss password ${{ secrets.PRESTOOSS_PUBLISH_TOKEN }}" > ~/.netrc
+          token: ${{ secrets.PRESTODB_CI_TOKEN }}
+          show-progress: false
+          persist-credentials: true
+      - uses: actions/setup-node@v4
+      - name: Configure git
+        run: |
+          git config --global --add safe.directory ${{ github.workspace }}
+          git config --global user.email "$GIT_CI_EMAIL"
+          git config --global user.name "$GIT_CI_USER"
+      - name: Configure git credentials
+        env:
+          PRESTODB_CI_TOKEN: ${{ secrets.PRESTODB_CI_TOKEN }}
+        run: |
+          git config --global credential.helper store
+          printf 'https://%s:%s@github.com\n' "$GIT_CI_USER" "$PRESTODB_CI_TOKEN" > ~/.git-credentials
+          chmod 600 ~/.git-credentials
       - name: Release to GitHub Pages
+        env:
+          GIT_USER: ${{ env.GIT_CI_USER }}
         run: |
           set -o pipefail
-          cd website && yarn install && GIT_USER="presto-oss" yarn run publish-gh-pages | (head -c 32768; echo "... skipping output ..."; tail -c 32768)
+          cd website && yarn install && yarn run publish-gh-pages | (head -c 32768; echo "... skipping output ..."; tail -c 32768)