diff --git a/.github/workflows/stable-merge.yml b/.github/workflows/stable-merge.yml
index 54ce84245b..74528fb048 100644
--- a/.github/workflows/stable-merge.yml
+++ b/.github/workflows/stable-merge.yml
@@ -5,6 +5,7 @@ on:
     workflows: [CI Pipeline]
     types:
     - completed
+  workflow_dispatch:
 
 jobs:
   master-merge:
@@ -16,6 +17,18 @@ jobs:
       with:
         fetch-depth: 0
 
+    - name: Restore
+      run: dotnet restore
+
+    - name: Build ReleaseNotes
+      run: dotnet build -c Release -p:TGS_HOST_NO_WEBPANEL=true tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj
+
+    - name: Run ReleaseNotes Create CI Completion Check (PR HEAD)
+      run: dotnet run -c Release --no-build --project tools/Tgstation.Server.ReleaseNotes --token-output-file ${{ runner.temp }}/installation_secret.txt ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }}
+
+    - name: Load Installation Token into Envvar
+      run: echo "INSTALLATION_TOKEN=$(cat ${{ runner.temp }}/installation_secret.txt)" >> $GITHUB_ENV
+
     - name: Merge master into dev
       uses: robotology/gh-action-nightly-merge@14b4a4cf358f7479aa708bee05cf8a794d6a2516 #v1.5.0
       with:
@@ -25,7 +38,6 @@ jobs:
         allow_forks: true
         user_name: tgstation-server
         user_email: tgstation-server@users.noreply.github.com
-        push_token: DEV_PUSH_TOKEN
+        push_token: INSTALLATION_TOKEN
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        DEV_PUSH_TOKEN: ${{ secrets.DEV_PUSH_TOKEN }}
diff --git a/tools/Tgstation.Server.ReleaseNotes/Program.cs b/tools/Tgstation.Server.ReleaseNotes/Program.cs
index b74af3b701..2bcc722b7e 100644
--- a/tools/Tgstation.Server.ReleaseNotes/Program.cs
+++ b/tools/Tgstation.Server.ReleaseNotes/Program.cs
@@ -61,6 +61,7 @@ namespace Tgstation.Server.ReleaseNotes
 			var fullNotes = versionString.Equals("--generate-full-notes", StringComparison.OrdinalIgnoreCase);
 			var nuget = versionString.Equals("--nuget", StringComparison.OrdinalIgnoreCase);
 			var ciCompletionCheck = versionString.Equals("--ci-completion-check", StringComparison.OrdinalIgnoreCase);
+			var genToken = versionString.Equals("--token-output-file", StringComparison.OrdinalIgnoreCase);
 
 			if ((!Version.TryParse(versionString, out var version) || version.Revision != -1)
 				&& !ensureRelease
@@ -150,6 +151,22 @@ namespace Tgstation.Server.ReleaseNotes
 					return await CICompletionCheck(client, args[1], args[2]);
 				}
 
+
+				if (genToken)
+				{
+					if (args.Length < 3)
+					{
+						Console.WriteLine("Missing output file path or PEM Base64 for app authentication!");
+						return 33847;
+					}
+
+					await GenerateAppCredentials(client, args[2]);
+
+					var token = client.Credentials.GetToken();
+					await File.WriteAllTextAsync(args[1], token);
+					return 0;
+				}
+
 				if (shaCheck)
 				{
 					if(args.Length < 2)
@@ -1610,7 +1627,7 @@ package (version) distribution(s); urgency=urgency
 			return 0;
 		}
 
-		static async ValueTask<int> CICompletionCheck(GitHubClient gitHubClient, string currentSha, string pemBase64)
+		static async ValueTask GenerateAppCredentials(GitHubClient gitHubClient, string pemBase64)
 		{
 			var pemBytes = Convert.FromBase64String(pemBase64);
 			var pem = Encoding.UTF8.GetString(pemBytes);
@@ -1639,10 +1656,15 @@ package (version) distribution(s); urgency=urgency
 			var installToken = await gitHubClient.GitHubApps.CreateInstallationToken(installation.Id);
 
 			gitHubClient.Credentials = new Credentials(installToken.Token);
+		}
+
+		static async ValueTask<int> CICompletionCheck(GitHubClient gitHubClient, string currentSha, string pemBase64)
+		{
+			await GenerateAppCredentials(gitHubClient, pemBase64);
 
 			await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Completion", currentSha)
 			{
-				CompletedAt = now,
+				CompletedAt = DateTime.UtcNow,
 				Conclusion = CheckConclusion.Success,
 				Output = new NewCheckRunOutput("CI Completion", "The CI Pipeline completed successfully"),
 				Status = CheckStatus.Completed,