diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml
index a304a73b..869ea7ec 100644
--- a/.github/workflows/pr-quality.yml
+++ b/.github/workflows/pr-quality.yml
@@ -1,106 +1,116 @@
 name: PR Quality
 
-permissions:
-    contents: read
-    issues: read
-    pull-requests: write
+permissions: {}
 
 on:
-    pull_request_target:
-        types: [opened, reopened]
+  pull_request_target:
+    types: [opened, reopened]
 
 jobs:
-    pr-quality:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: peakoss/anti-slop@v0
-              with:
-                  # General Settings
-                  max-failures: 4
+  pr-quality:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create bot app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: read
+          permission-issues: read
+          permission-pull-requests: write
 
-                  # PR Branch Checks
-                  allowed-target-branches: "main"
-                  blocked-target-branches: ""
-                  allowed-source-branches: ""
-                  blocked-source-branches: ""
+      - uses: peakoss/anti-slop@v0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
 
-                  # PR Quality Checks
-                  max-negative-reactions: 0
-                  require-maintainer-can-modify: true
+          # General Settings
+          max-failures: 4
 
-                  # PR Title Checks
-                  require-conventional-title: true
+          # PR Branch Checks
+          allowed-target-branches: "main"
+          blocked-target-branches: ""
+          allowed-source-branches: ""
+          blocked-source-branches: ""
 
-                  # PR Description Checks
-                  require-description: true
-                  max-description-length: 2500
-                  max-emoji-count: 0
-                  max-code-references: 0
-                  require-linked-issue: false
-                  blocked-terms: ""
-                  blocked-issue-numbers: ""
+          # PR Quality Checks
+          max-negative-reactions: 0
+          require-maintainer-can-modify: true
 
-                  # PR Template Checks
-                  require-pr-template: true
-                  strict-pr-template-sections: "Contributing Guidelines"
-                  optional-pr-template-sections: "Issues"
-                  max-additional-pr-template-sections: 3
+          # PR Title Checks
+          require-conventional-title: true
 
-                  # Commit Message Checks
-                  max-commit-message-length: 500
-                  require-conventional-commits: false
-                  require-commit-author-match: true
-                  blocked-commit-authors: ""
+          # PR Description Checks
+          require-description: true
+          max-description-length: 2500
+          max-emoji-count: 0
+          max-code-references: 0
+          require-linked-issue: false
+          blocked-terms: ""
+          blocked-issue-numbers: ""
 
-                  # File Checks
-                  allowed-file-extensions: ""
-                  allowed-paths: ""
-                  blocked-paths: |
-                      SECURITY.md
-                      LICENSE
-                  require-final-newline: false
-                  max-added-comments: 0
+          # PR Template Checks
+          require-pr-template: true
+          strict-pr-template-sections: "Contributing Guidelines"
+          optional-pr-template-sections: "Issues"
+          max-additional-pr-template-sections: 3
 
-                  # User Checks
-                  detect-spam-usernames: true
-                  min-account-age: 30
-                  max-daily-forks: 7
-                  min-profile-completeness: 4
+          # Commit Message Checks
+          max-commit-message-length: 500
+          require-conventional-commits: false
+          require-commit-author-match: true
+          blocked-commit-authors: ""
 
-                  # Merge Checks
-                  min-repo-merged-prs: 0
-                  min-repo-merge-ratio: 0
-                  min-global-merge-ratio: 30
-                  global-merge-ratio-exclude-own: false
+          # File Checks
+          allowed-file-extensions: ""
+          allowed-paths: ""
+          blocked-paths: |
+            SECURITY.md
+            LICENSE
+          require-final-newline: false
+          max-added-comments: 0
 
-                  # Exemptions
-                  exempt-draft-prs: false
-                  exempt-bots: |
-                      actions-user
-                      dependabot[bot]
-                      renovate[bot]
-                      github-actions[bot]
-                  exempt-users: "James18232"
-                  exempt-author-association: "OWNER,MEMBER,COLLABORATOR"
-                  exempt-label: "quality/exempt"
-                  exempt-pr-label: ""
-                  exempt-all-milestones: false
-                  exempt-all-pr-milestones: false
-                  exempt-milestones: ""
-                  exempt-pr-milestones: ""
+          # User Checks
+          detect-spam-usernames: true
+          min-account-age: 30
+          max-daily-forks: 7
+          min-profile-completeness: 4
 
-                  # PR Success Actions
-                  success-add-pr-labels: "quality/verified"
+          # Merge Checks
+          min-repo-merged-prs: 0
+          min-repo-merge-ratio: 0
+          min-global-merge-ratio: 30
+          global-merge-ratio-exclude-own: false
 
-                  # PR Failure Actions
-                  failure-remove-pr-labels: ""
-                  failure-remove-all-pr-labels: true
-                  failure-add-pr-labels: "quality/rejected"
-                  failure-pr-message: |
-                      This PR did not pass quality checks so it will be closed.
-                      See the [workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}) for details on which checks failed.
+          # Exemptions
+          exempt-draft-prs: false
+          exempt-bots: |
+            actions-user
+            dependabot[bot]
+            renovate[bot]
+            github-actions[bot]
+            pocket-id-bot[bot]
+          exempt-users: "James18232"
+          exempt-author-association: "OWNER,MEMBER,COLLABORATOR"
+          exempt-label: "quality/exempt"
+          exempt-pr-label: ""
+          exempt-all-milestones: false
+          exempt-all-pr-milestones: false
+          exempt-milestones: ""
+          exempt-pr-milestones: ""
 
-                      If you believe this is a mistake please let us know.
+          # PR Success Actions
+          success-add-pr-labels: "quality/verified"
 
-                  close-pr: true
-                  lock-pr: false
+          # PR Failure Actions
+          failure-remove-pr-labels: ""
+          failure-remove-all-pr-labels: true
+          failure-add-pr-labels: "quality/rejected"
+          failure-pr-message: |
+            This PR did not pass quality checks so it will be closed.
+            See the [workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}) for details on which checks failed.
+
+            If you believe this is a mistake please let us know.
+
+          close-pr: true
+          lock-pr: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 50411fae..50b0a505 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -119,7 +119,7 @@ jobs:
           # Attribute the release commit to the app and authenticate the push with its installation token
           bot_name="$APP_SLUG[bot]"
           bot_id=$(gh api "users/$bot_name" --jq .id)
-          git config user.name "$bot_name"
+          git config user.name "Pocket ID Bot"
           git config user.email "$bot_id+$bot_name@users.noreply.github.com"
           gh auth setup-git
 
diff --git a/.github/workflows/update-aaguids.yml b/.github/workflows/update-aaguids.yml
index 4c0957ba..4362d919 100644
--- a/.github/workflows/update-aaguids.yml
+++ b/.github/workflows/update-aaguids.yml
@@ -6,8 +6,7 @@ on:
   workflow_dispatch: # Allows manual triggering of the workflow
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   update-aaguids:
@@ -16,6 +15,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -25,9 +26,31 @@ jobs:
       - name: Update AAGUIDs and authenticator icons
         run: go run scripts/update-aaguids.go
 
+      - name: Create bot app token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Get bot commit identity
+        id: bot
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+        run: |
+          bot_name="$APP_SLUG[bot]"
+          bot_id=$(gh api "users/$bot_name" --jq .id)
+          echo "identity=Pocket ID Bot <$bot_id+$bot_name@users.noreply.github.com>" >> "$GITHUB_OUTPUT"
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v7
         with:
+          token: ${{ steps.app-token.outputs.token }}
+          author: ${{ steps.bot.outputs.identity }}
+          committer: ${{ steps.bot.outputs.identity }}
           commit-message: "chore: update AAGUIDs"
           title: "chore: update AAGUIDs"
           body: |