diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c38b7b86..48db1a54 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -349,5 +349,6 @@ jobs:
     if: ${{ inputs.build_ios && success() }}
     needs: [release]
     uses: ./.github/workflows/update-altstore.yml
+    secrets: inherit
     with:
       tag: ${{ needs.release.outputs.tag }}
diff --git a/.github/workflows/update-altstore.yml b/.github/workflows/update-altstore.yml
index 822a450c..1610e7cf 100644
--- a/.github/workflows/update-altstore.yml
+++ b/.github/workflows/update-altstore.yml
@@ -22,6 +22,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
+          # Default GITHUB_TOKEN cannot bypass the "changes through PR only"
+          # branch ruleset; REPO_TOKEN can (same as the release workflow).
+          token: ${{ secrets.REPO_TOKEN }}
       - name: Get version info from release
         run: |
           TAG="${{ inputs.tag }}"