diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index cd1e078..c6b8d6a 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -9,10 +9,13 @@ jobs:
     env:
       RELEASE_REPOSITORY: pypi
       RELEASE_PACKAGE_NAME: emnify-sdk
-      RELEASE_PYPI_TOKEN: ${{secrets.PYPI_RELEASE_TOKEN}}
     name: Bump and Release
-    # Prevent circular workflow run
-    if: "!contains(github.event.pusher.name, 'emnify-gha')"
+    permissions:
+      contents: write
+    # Prevent circular workflow run. Keyed on the commit message rather than the
+    # pusher, which is no longer a fixed user name. (Belt and braces: pushes made
+    # with GITHUB_TOKEN do not trigger workflows.)
+    if: "!contains(github.event.head_commit.message, '[Automated] Version Bump')"
     runs-on: ubuntu-latest
 
     steps:
@@ -21,10 +24,7 @@ jobs:
         with:
           access_token: ${{ github.token }}
 
-
       - uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.EMNIFY_GITHUB_ACTIONS_TOKEN }}
 
       - name: Bump version and push tag
         id: tag_version
@@ -55,11 +55,13 @@ jobs:
           commit_message: '[Automated] Version Bump from ${{ env.current_version }} to ${{ env.new_version }}'
 
       - name: Release and Publish Package
+        env:
+          RELEASE_PYPI_TOKEN: ${{ secrets.PYPI_RELEASE_TOKEN }}
         run: |
           cat <<EOT >> .env
           TWINE_REPOSITORY=${{env.RELEASE_REPOSITORY}}
           TWINE_USERNAME=__token__
-          TWINE_PASSWORD=${{env.RELEASE_PYPI_TOKEN}}
+          TWINE_PASSWORD=${RELEASE_PYPI_TOKEN}
           PYPI_PACKAGE_NAME=${{env.RELEASE_PACKAGE_NAME}}
           EOT