diff --git a/.github/workflows/fast-revert.yml b/.github/workflows/fast-revert.yml
index 55db505943..37b5797381 100644
--- a/.github/workflows/fast-revert.yml
+++ b/.github/workflows/fast-revert.yml
@@ -10,7 +10,7 @@ on:
         required: true
         description: '`name <email>` for triggering user'
 
-# disable all permissions -- we use the PAT's permissions instead
+# Disable the default token permissions; the GitHub App token below supplies access.
 permissions: {}
 
 jobs:
@@ -19,15 +19,15 @@ jobs:
     if: |
       github.event_name == 'workflow_dispatch' || github.event.label.name == 'Trigger: Revert'
     steps:
-    - name: Get auth token
-      id: token
-      uses: getsentry/action-github-app-token@5c1e90706fe007857338ac1bfbd7a4177db2f789 # v4.0.0
+    - name: fast-revert bot token
+      id: fast-revert-bot-token
+      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       with:
-        app_id: ${{ secrets.FAST_REVERT_BOT_APP_ID }}
-        private_key: ${{ secrets.GH_FAST_REVERT_PRIVATE_KEY }}
+        client-id: ${{ secrets.FAST_REVERT_BOT_APP_ID }}
+        private-key: ${{ secrets.GH_FAST_REVERT_PRIVATE_KEY }}
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
-        token: ${{ steps.token.outputs.token }}
+        token: ${{ steps.fast-revert-bot-token.outputs.token }}
     - uses: getsentry/action-fast-revert@35b4b6c1f8f91b5911159568b3b15e531b5b8174 # v2.0.1
       with:
         pr: ${{ github.event.number || github.event.inputs.pr }}
@@ -35,14 +35,14 @@ jobs:
           ${{ github.event.inputs.co_authored_by || format('{0}\n<{1}+{0}@users.noreply.github.com>', github.event.sender.login, github.event.sender.id) }}
         committer_name: sentry-snuba-fast-revert-bot[bot]
         committer_email: 257653817+sentry-snuba-fast-revert-bot[bot]@users.noreply.github.com
-        token: ${{ steps.token.outputs.token }}
+        token: ${{ steps.fast-revert-bot-token.outputs.token }}
     - name: comment on failure
       env:
         GITHUB_REPOSITORY: ${{ github.repository }}
         GITHUB_RUN_ID: ${{ github.run_id }}
         REPOSITORY_ID: ${{ github.event.repository.id }}
         PR_NUMBER: ${{ github.event.number || github.event.inputs.pr }}
-        GITHUB_TOKEN: ${{ secrets.GETSENTRY_BOT_REVERT_TOKEN }}
+        GITHUB_TOKEN: ${{ steps.fast-revert-bot-token.outputs.token }}
       run: |
         curl \
             --silent \