diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 2935d961a7..233c7fb51e 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -73,7 +73,8 @@ For the full CI gambit, the following repository configuration must be set:
 
 If you don't plan on deploying TGS, the following secrets can be omitted:
 
-- Secret `DEV_PUSH_TOKEN`: A GitHub token with read/write access to the repository. Enables doxygen pushes to `gh-pages` branch, and releases creation.
+- Secret `DEV_PUSH_TOKEN`: A repo scoped GitHub PAT with read/write access on the repository and the ability to trigger workflows on https://github.com/tgstation/tgstation-ppa. Used to trigger debian repo rebuilds, bypass rate limits, update milestones, and create winget package acceptance PRs.
+- Secret `TGS_CI_GITHUB_APP_TOKEN_BASE64` is a base 64 encoded private key for a GitHub App. This app must be installed on the repo and have read/write access to checks and contents. Used to generate CI checks, push changelogs, and create releases.
 - Secret `DOCKER_USERNAME`: Login username for Docker image push.
 - Secret `DOCKER_PASSWORD`: Login password for Docker image push.
 - Secret `NUGET_API_KEY`: Nuget.org API Key for client libraries push.
diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml
index 82d9ad2abf..117edb9ab9 100644
--- a/.github/workflows/ci-pipeline.yml
+++ b/.github/workflows/ci-pipeline.yml
@@ -42,7 +42,6 @@ env:
   TGS_DOTNET_QUALITY: ga
   TGS_TEST_GITHUB_TOKEN: ${{ secrets.LIVE_TESTS_TOKEN }}
   TGS_RELEASE_NOTES_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
-  WINGET_PUSH_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
   PACKAGING_PRIVATE_KEY_PASSPHRASE: ${{ secrets.PACKAGING_PRIVATE_KEY_PASSPHRASE }}
   CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
@@ -1486,11 +1485,17 @@ jobs:
     - name: Generate Release Notes
       run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes ${{ env.TGS_API_VERSION }} --httpapi
 
+    - name: Generate App Token
+      run: |
+        dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
+        echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
+        rm ${{ runner.temp }}/installation_secret.txt
+
     - name: Create GitHub Release
       uses: actions/create-release@v1
       id: create_release
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         tag_name: api-v${{ env.TGS_API_VERSION }}
         release_name: tgstation-server API v${{ env.TGS_API_VERSION }}
@@ -1500,7 +1505,7 @@ jobs:
     - name: Upload OpenApi Spec
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./swagger/tgs_api.json
@@ -1549,11 +1554,17 @@ jobs:
     - name: Generate Release Notes
       run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes ${{ env.TGS_DM_VERSION }} --dmapi
 
+    - name: Generate App Token
+      run: |
+        dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
+        echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
+        rm ${{ runner.temp }}/installation_secret.txt
+
     - name: Create GitHub Release
       uses: actions/create-release@v1
       id: create_release
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         tag_name: dmapi-v${{ env.TGS_DM_VERSION }}
         release_name: tgstation-server DMAPI v${{ env.TGS_DM_VERSION }}
@@ -1563,7 +1574,7 @@ jobs:
     - name: Upload DMAPI Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./DMAPI.zip
@@ -1643,7 +1654,7 @@ jobs:
       run: dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
 
     - name: Run ReleaseNotes with --ensure-release
-      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --ensure-release
+      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --ensure-release ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
 
   deploy-tgs:
     name: Deploy TGS
@@ -1766,11 +1777,17 @@ jobs:
     - name: Generate Release Notes
       run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes ${{ env.TGS_VERSION }}
 
+    - name: Generate App Token
+      run: |
+        dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
+        echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
+        rm ${{ runner.temp }}/installation_secret.txt
+
     - name: Create GitHub Release
       uses: actions/create-release@v1
       id: create_release
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         tag_name: tgstation-server-v${{ env.TGS_VERSION }}
         release_name: tgstation-server-v${{ env.TGS_VERSION }}
@@ -1780,7 +1797,7 @@ jobs:
     - name: Upload Server Console Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./ServerConsole.zip
@@ -1790,7 +1807,7 @@ jobs:
     - name: Upload Server Service Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./ServerService.zip
@@ -1800,7 +1817,7 @@ jobs:
     - name: Upload DMAPI Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./DMAPI.zip
@@ -1810,7 +1827,7 @@ jobs:
     - name: Upload OpenApi Spec Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./swagger/tgs_api.json
@@ -1820,7 +1837,7 @@ jobs:
     - name: Upload Server Update Package Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./ServerUpdatePackage.zip
@@ -1830,7 +1847,7 @@ jobs:
     - name: Upload Debian Pacakaging Artifact
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./packaging-debian/tgstation-server-v${{ env.TGS_VERSION }}.debian.packaging.tar.xz
@@ -1840,7 +1857,7 @@ jobs:
     - name: Upload MariaDB .msi
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./build/package/winget/Tgstation.Server.Host.Service.Wix.Bundle/bin/Release/mariadb.msi
@@ -1850,7 +1867,7 @@ jobs:
     - name: Upload Installer .exe
       uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ env.INSTALLATION_TOKEN }}
       with:
         upload_url: ${{ steps.create_release.outputs.upload_url }}
         asset_path: ./build/package/winget/tgstation-server-installer.exe
@@ -1966,7 +1983,7 @@ jobs:
     - name: Install winget
       uses: Cyberboss/install-winget@v1
       with:
-        GITHUB_TOKEN: ${{ env.WINGET_PUSH_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
 
     - name: Install wingetcreate
       run: winget install wingetcreate --version 1.2.8.0 --disable-interactivity --accept-source-agreements # Pinned due to breaking every other version
diff --git a/tools/Tgstation.Server.ReleaseNotes/Program.cs b/tools/Tgstation.Server.ReleaseNotes/Program.cs
index d65432f591..26b6c55392 100644
--- a/tools/Tgstation.Server.ReleaseNotes/Program.cs
+++ b/tools/Tgstation.Server.ReleaseNotes/Program.cs
@@ -128,7 +128,17 @@ namespace Tgstation.Server.ReleaseNotes
 			try
 			{
 				if (ensureRelease)
+				{
+					if (args.Length < 2)
+					{
+						Console.WriteLine("Missing PEM Base64 for updating release!");
+						return 454233;
+					}
+
+					await GenerateAppCredentials(client, args[1]);
+
 					return await EnsureRelease(client);
+				}
 
 				if (linkWinget)
 				{