diff --git a/.github/workflows/tag-untagged-releases-rust.yml b/.github/workflows/tag-untagged-releases-rust.yml
index 781999b..47d7274 100644
--- a/.github/workflows/tag-untagged-releases-rust.yml
+++ b/.github/workflows/tag-untagged-releases-rust.yml
@@ -69,9 +69,27 @@ jobs:
       - name: Add any missing tags
         run: cargo release tag -v --execute --no-confirm || true
 
+      - name: Mask GitHub App token
+        env:
+          TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: echo "::add-mask::${TOKEN}"
+
+      - name: Configure Git credentials for tag push
+        run: |
+          git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
+        env:
+          TOKEN: ${{ steps.generate_token.outputs.token }}
+
       - name: Push any new tags
         run: cargo release push -v --execute --no-confirm
 
+      - name: Remove Git credentials override
+        if: always()
+        env:
+          TOKEN: ${{ steps.generate_token.outputs.token }}
+        run: |
+          git config --global --unset-all url."https://x-access-token:${TOKEN}@github.com/".insteadOf
+
       - name: Capture tags after
         run: |
           EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)