diff --git a/.autorc b/.autorc
index 3b73641..c7f2a75 100644
--- a/.autorc
+++ b/.autorc
@@ -10,6 +10,12 @@
     "plugins": [
         "git-tag",
         "released",
+        [
+            "protected-branch",
+            {
+                "requiredStatusChecks": ["pre-commit.ci - pr"]
+            }
+        ],
         "first-time-contributor",
         [
             "omit-commits",
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ec16778..e8a09e9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -21,25 +21,9 @@ jobs:
           wget -O- "$auto_download_url" | gunzip > ~/auto
           chmod a+x ~/auto
 
-      # Workaround to avoid PRs for CHANGELOG updates
-      # Adapted from https://github.com/intuit/auto/issues/1491#issuecomment-1610120918
-      - name: Temporarily allow force pushes
-        uses: benjefferies/branch-protection-bot@master
-        if: always()
-        with:
-          access_token: ${{ secrets.NB_PAT_RELEASE_PROTECTED }}
-          branch: ${{ github.event.repository.default_branch }}
-
       - name: Release
         run: ~/auto shipit -vv
         env:
-          GH_TOKEN: ${{ secrets.NB_PAT_RELEASE_PROTECTED }}
+          GH_TOKEN: ${{ secrets.NB_RELEASE_CLASSIC_PAT }}
           # GH_TOKEN: ${{ secrets.NB_PAT_RELEASE }}
-          # PROTECTED_BRANCH_REVIEWER_TOKEN: ${{ secrets.NB_PAT_RELEASE_PROTECTED }}
-
-      - name: Disable allow force pushes
-        uses: benjefferies/branch-protection-bot@master
-        if: always()
-        with:
-          access_token: ${{ secrets.NB_PAT_RELEASE_PROTECTED }}
-          branch: ${{ github.event.repository.default_branch }}
+          PROTECTED_BRANCH_REVIEWER_TOKEN: ${{ secrets.NB_PAT_RELEASE_PROTECTED }}