diff --git a/.github/workflows/bump-idfkit.yml b/.github/workflows/bump-idfkit.yml
index 40ccde4..092b28b 100644
--- a/.github/workflows/bump-idfkit.yml
+++ b/.github/workflows/bump-idfkit.yml
@@ -49,6 +49,8 @@ env:
 jobs:
   bump:
     runs-on: ubuntu-latest
+    env:
+      HAS_APP: ${{ secrets.APP_ID != '' && secrets.APP_PRIVATE_KEY != '' }}
     timeout-minutes: 15
     steps:
       - name: Check out
@@ -76,17 +78,30 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "previous=$(python3 -c 'import json;print(json.load(open(".mcp.json"))["mcpServers"]["idfkit"]["args"][0])')" >> "$GITHUB_OUTPUT"
 
+      # The consumer register lives in idfkit-conformance, so recording an adoption there is a dispatch
+      # into another repository. The organisation's GitHub App (idfkit-bot) mints a token for that one
+      # repository, valid for an hour, rather than a personal token stored for months. Without APP_ID
+      # and APP_PRIVATE_KEY this step is skipped and the steps below say what to run instead.
+      - name: Mint a token that can dispatch in idfkit-conformance
+        id: app-token
+        if: env.HAS_APP == 'true'
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: idfkit-conformance
       - name: Decline, and record why
         if: inputs.decline_reason != ''
         env:
-          GH_TOKEN: ${{ secrets.CONFORMANCE_DISPATCH_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REASON: ${{ inputs.decline_reason }}
         run: |
           set -euo pipefail
           command=(gh workflow run record-adoption.yml -R idfkit/idfkit-conformance
                    -f consumer="$CONSUMER" -f library=python -f outcome=decline -f reason="$REASON")
           if [ -z "$GH_TOKEN" ]; then
-            echo "::error title=Decline not recorded::No CONFORMANCE_DISPATCH_TOKEN, so the deliberate lag cannot be recorded from here. Run: ${command[*]}"
+            echo "::error title=Decline not recorded::No APP_ID/APP_PRIVATE_KEY, so the deliberate lag cannot be recorded from here. Run: ${command[*]}"
             exit 1
           fi
           "${command[@]}"