diff --git a/.github/release.yml b/.github/release.yml
index a12c9ce22..e6eeb0e9d 100644
--- a/.github/release.yml
+++ b/.github/release.yml
@@ -1,6 +1,9 @@
 # https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes#configuring-automatically-generated-release-notes
 
 changelog:
+  exclude:
+    labels:
+      - tagpr
   categories:
     - title: 💥 Breaking Changes
       labels:
diff --git a/.github/workflows/add_to_octokit_project.yml b/.github/workflows/add_to_octokit_project.yml
deleted file mode 100644
index 8621996e4..000000000
--- a/.github/workflows/add_to_octokit_project.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Add PRs and issues to Octokit org project
-
-on:
-  issues:
-    types: [reopened, opened]
-  pull_request_target:
-    types: [reopened, opened]
-
-jobs:
-  add-to-project:
-    name: Add issue to project
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/add-to-project@v1.0.2
-        with:
-          project-url: https://github.com/orgs/octokit/projects/10
-          github-token: ${{ secrets.OCTOKITBOT_PROJECT_ACTION_TOKEN }}
-          labeled: "Status: Stale"
-          label-operator: NOT
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7541f873d..31978d2c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,13 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
+      - name: Fetch GitHub App Token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: token
+        with:
+          app-id: ${{ secrets.GH_APP_TAGPR_ID }}
+          private-key: ${{ secrets.GH_APP_TAGPR_PKEY }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # Allow goreleaser to access older tag information.
@@ -40,6 +47,5 @@ jobs:
           args: release --clean
           version: latest
         env:
-          # GitHub sets the GITHUB_TOKEN secret automatically.
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
diff --git a/.github/workflows/tagpr.yml b/.github/workflows/tagpr.yml
new file mode 100644
index 000000000..29bf0b63f
--- /dev/null
+++ b/.github/workflows/tagpr.yml
@@ -0,0 +1,39 @@
+name: tagpr
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  tagpr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch GitHub App Token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: token
+        with:
+          app-id: ${{ secrets.GH_APP_TAGPR_ID }}
+          private-key: ${{ secrets.GH_APP_TAGPR_PKEY }}
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          token: ${{ steps.token.outputs.token }}
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+
+      - name: Run tagpr
+        uses: Songmu/tagpr@9c294c8b7b1815a5f3b7c61d6ee6aa50ac25b030 # v1.8.4
+        env:
+          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
+