diff --git a/.github/workflows/create-next-release-branch.yml b/.github/workflows/create-next-release-branch.yml
index 6a48327dc04..5f537a5418a 100644
--- a/.github/workflows/create-next-release-branch.yml
+++ b/.github/workflows/create-next-release-branch.yml
@@ -42,10 +42,12 @@ jobs:
             GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY
       - name: "Generate token"
         id: generate_token
-        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
         with:
           app_id: ${{ vars.DELIVERY_BOT_APP_ID }}
           private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }}
+          repositories: "[\"grafana\", \"grafana-enterprise\"]"
+          permissions: "{\"contents\": \"write\", \"pull_requests\": \"write\", \"workflows\":\"write\"}"
       - name: Create release branch
         id: branch
         uses: grafana/grafana-github-actions-go/bump-release@main # zizmor: ignore[unpinned-uses]
diff --git a/.github/workflows/release-comms.yml b/.github/workflows/release-comms.yml
index e0bd93d3b7d..5208b3a4606 100644
--- a/.github/workflows/release-comms.yml
+++ b/.github/workflows/release-comms.yml
@@ -44,13 +44,6 @@ jobs:
       VERSION: ${{ inputs.version }}
     runs-on: ubuntu-latest
     steps:
-    - name: "Get vault secrets"
-      id: vault-secrets
-      uses: grafana/shared-workflows/actions/get-vault-secrets@main
-      with:
-        # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault
-        repo_secrets: |
-          GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY
     - if: ${{ github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/') }}
       run: |
         {
@@ -73,14 +66,14 @@ jobs:
   create_next_release_branch_grafana:
     name: Create next release branch (Grafana)
     needs: setup
-    uses: ./.github/workflows/create-next-release-branch.yml
+    uses: grafana/grafana/.github/workflows/create-next-release-branch.yml@main
     with:
       ownerRepo: 'grafana/grafana'
       source: ${{ needs.setup.outputs.release_branch }}
   create_next_release_branch_enterprise:
     name: Create next release branch (Grafana Enterprise)
     needs: setup
-    uses: ./.github/workflows/create-next-release-branch.yml
+    uses: grafana/grafana/.github/workflows/create-next-release-branch.yml@main
     with:
       ownerRepo: 'grafana/grafana-enterprise'
       source: ${{ needs.setup.outputs.release_branch }}
@@ -88,7 +81,7 @@ jobs:
     needs:
       - setup
       - create_next_release_branch_grafana
-    uses: ./.github/workflows/migrate-prs.yml
+    uses: grafana/grafana/.github/workflows/migrate-prs.yml@main
     with:
       ownerRepo: 'grafana/grafana'
       from: ${{ needs.setup.outputs.release_branch }}
@@ -97,14 +90,14 @@ jobs:
     needs:
       - setup
       - create_next_release_branch_enterprise
-    uses: ./.github/workflows/migrate-prs.yml
+    uses: grafana/grafana/.github/workflows/migrate-prs.yml@main
     with:
       ownerRepo: 'grafana/grafana-enterprise'
       from: ${{ needs.setup.outputs.release_branch }}
       to: ${{ needs.create_next_release_branch_enterprise.outputs.branch }}
   post_changelog_on_forum:
     needs: setup
-    uses: ./.github/workflows/community-release.yml
+    uses: grafana/grafana/.github/workflows/community-release.yml@main
     with:
       version: ${{ needs.setup.outputs.version }}
       dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
@@ -113,7 +106,7 @@ jobs:
     # The github-release action retrieves the changelog using the /repos/grafana/grafana/contents/CHANGELOG.md API
     # endpoint.
     needs: setup
-    uses: ./.github/workflows/github-release.yml
+    uses: grafana/grafana/.github/workflows/github-release.yml@main
     with:
       version: ${{ needs.setup.outputs.version }}
       dry_run: ${{ needs.setup.outputs.dry_run == 'true' }}
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 02f283e5d0b..fb6a9f2058a 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -16,10 +16,6 @@ on:
         required: true
         type: string
         description: The version of Grafana that is being released (without the `v` prefix)`
-      target:
-        required: true
-        type: string
-        description: The release branch pattern (eg v9.5.x) that these changes are being merged into
       changelog:
         required: false
         type: boolean
@@ -73,19 +69,28 @@ jobs:
         id: vault-secrets
         uses: grafana/shared-workflows/actions/get-vault-secrets@main
         with:
-          # Secrets placed in the ci/data/repo/grafana/grafana/delivery-bot-app path in Vault
           repo_secrets: |
             GRAFANA_DELIVERY_BOT_APP_PEM=delivery-bot-app:PRIVATE_KEY
+      - name: Generate token
+        id: generate_changelog_token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
+        with:
+          app_id: ${{ vars.DELIVERY_BOT_APP_ID }}
+          private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }}
+          repositories: "[\"grafana\", \"grafana-enterprise\"]"
+          permissions: "{\"contents\": \"write\", \"pull_requests\": \"write\", \"workflows\":\"write\"}"
       - run: echo "RELEASE_BRANCH=release-${VERSION}" >> "$GITHUB_ENV"
       - name: Checkout Grafana
         uses: actions/checkout@v4
         with:
+          token: ${{ steps.generate_changelog_token.outputs.token }}
           ref: ${{ env.RELEASE_BRANCH }}
           fetch-tags: true
           fetch-depth: 0
       - name: Checkout Grafana (main)
         uses: actions/checkout@v4
         with:
+          token: ${{ steps.generate_changelog_token.outputs.token }}
           ref: main
           fetch-depth: '0'
           path: .grafana-main
@@ -94,21 +99,17 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version-file: .nvmrc
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
       - name: Configure git user
         run: |
-          git config --local user.name "github-actions[bot]"
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "grafana-delivery-bot[bot]"
+          git config --local user.email "grafana-delivery-bot[bot]@users.noreply.github.com"
           git config --local --add --bool push.autoSetupRemote true
 
       - name: Create branch
         run: git checkout -b "release/${{ github.run_number }}/$VERSION"
-      - name: Generate changelog token
-        if: ${{ inputs.changelog == true || inputs.changelog == 'true' }}
-        id: generate_changelog_token
-        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92
-        with:
-          app_id: ${{ vars.DELIVERY_BOT_APP_ID }}
-          private_key: ${{ env.GRAFANA_DELIVERY_BOT_APP_PEM }}
       - name: Generate changelog
         id: changelog
         if: ${{ inputs.changelog == true || inputs.changelog == 'true' }}
@@ -156,13 +157,16 @@ jobs:
       - name: Commit CHANGELOG.md changes
         if: ${{ inputs.changelog == true || inputs.changelog == 'true' }}
         run: git add CHANGELOG.md && git commit --allow-empty -m "Update changelog" CHANGELOG.md
-
-      - name: Update package.json versions
+      - name: Bump versions
         if: ${{ inputs.bump == true || inputs.bump == 'true' }}
-        uses: ./.grafana-main/pkg/build/actions/bump-version
+        uses: dagger/dagger-for-github@e47aba410ef9bb9ed81a4d2a97df31061e5e842e
         with:
-          version: 'patch'
+          verb: run
+          args: go run -C .grafana-main ./pkg/build/actions/bump-version -version="patch"
 
+      - name: make gen-cue
+        shell: bash
+        run: make gen-cue
       - name: Add package.json changes
         if: ${{ inputs.bump == true || inputs.bump == 'true' }}
         run: |
@@ -171,14 +175,13 @@ jobs:
           git commit -m "Update version to $VERSION"
 
       - name: Git push
-        if: inputs.dry_run != true
         run: git push
       - name: Create PR
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BRANCH: ${{ steps.branch.outputs.branch }}
+          DRY_RUN: ${{ inputs.dry_run }}
         run: |
-          LATEST_FLAG=""
+          LATEST_FLAG=()
           if [ "$LATEST" = "true" ]; then
             LATEST_FLAG=(-l "release/latest")
           fi
@@ -186,6 +189,6 @@ jobs:
             "${LATEST_FLAG[@]}" \
             -l "no-changelog" \
             --dry-run="$DRY_RUN" \
-            -B "$BRANCH" \
+            -B "${RELEASE_BRANCH}" \
             --title "Release: $VERSION" \
             --body "These code changes must be merged after a release is complete"
diff --git a/pkg/build/actions/bump-version/action.yml b/pkg/build/actions/bump-version/action.yml
index 24ae182daf2..d7d6fdf5c50 100644
--- a/pkg/build/actions/bump-version/action.yml
+++ b/pkg/build/actions/bump-version/action.yml
@@ -12,9 +12,12 @@ runs:
         go-version-file: go.mod
     - name: Bump versions
       uses: dagger/dagger-for-github@e47aba410ef9bb9ed81a4d2a97df31061e5e842e
+      env:
+        GO_MOD_DIR: ${{ inputs.go-mod-dir }}
+        VERSION: ${{ inputs.version }}
       with:
         verb: run
-        args: go run ./pkg/build/actions/bump-version -version=${{ inputs.version }}
+        args: go run ./pkg/build/actions/bump-version -version=${VERSION}
     - name: make gen-cue
       shell: bash
       run: make gen-cue