diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index feb322fd33e..317aa9f333b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -253,6 +253,8 @@ jobs:
       - name: 'Publish tagged docs'
         run: util/publish-tagged-docs.sh ${{ env.DAGGER_RELEASE_VERSION }}
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: 'Clean bazel cache'
         # According to the documentation, we should be able to exclude these via
         # the actions/cache path, e.g. "!~/.cache/bazel/*/*/external/" but that
diff --git a/util/publish-tagged-docs.sh b/util/publish-tagged-docs.sh
index 6c08a182df9..df012867dd8 100755
--- a/util/publish-tagged-docs.sh
+++ b/util/publish-tagged-docs.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+# TODO(bcorso): Consider sharing this script with utils/generate-latest-docs.sh
 
 set -eux
 
@@ -21,8 +22,15 @@ fi
 
 # Publish javadocs to gh-pages
 bazel build //:user-docs.jar
-git clone --quiet --branch gh-pages \
-    https://github.com/google/dagger gh-pages > /dev/null
+
+# If a token exists, then use the token to clone the repo. This allows our
+# automated workflows to commit without manually authenticating.
+if [[ ! -z "$GH_TOKEN" ]]; then
+  git clone --quiet --branch=gh-pages https://x-access-token:${GH_TOKEN}@github.com/google/dagger gh-pages > /dev/null
+else
+  git clone --quiet --branch=gh-pages https://github.com/google/dagger gh-pages > /dev/null
+fi
+
 cd gh-pages
 unzip ../bazel-bin/user-docs.jar -d api/$VERSION_NAME
 rm -rf api/$VERSION_NAME/META-INF/