diff --git a/.github/workflows/translate.yml b/.github/workflows/translate.yml
index a6fe983a02..5e65b0e044 100644
--- a/.github/workflows/translate.yml
+++ b/.github/workflows/translate.yml
@@ -13,23 +13,22 @@ env:
 
 jobs:
   update-translations:
-    permissions:
-      contents: write
     name: Update Translations
     if: github.repository == 'beeware/beeware.github.io' && github.actor != 'brutusthebee'
     runs-on: ubuntu-latest
+    # GitHub writes use BRUTUS_PAT_TOKEN, so the job's own GITHUB_TOKEN needs
+    # no permissions.
+    permissions: {}
     steps:
       - name: Checkout
-        permissions:
-          contents: write
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 1
-          persist-credentials: false
           token: ${{ secrets.BRUTUS_PAT_TOKEN }}
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.X"
           cache: pip
@@ -44,9 +43,12 @@ jobs:
         run: python -m pip install --group translate
 
       - name: Configure git
+        env:
+          GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: |
           git config --local user.email "$(git log --pretty='%ae' -1)"
           git config --local user.name "brutusthebee[bot]"
+          gh auth setup-git
 
       - name: Configure Weblate
         env:
@@ -68,6 +70,8 @@ jobs:
       - name: Push Weblate changes
         run: wlc push
       - name: Pull translation updates pushed by Weblate
+        env:
+          GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: git pull origin
 
       - name: Regenerate PO files
@@ -88,7 +92,7 @@ jobs:
       - name: Commit updated translations
         if: steps.updated.outputs.updated == 'true'
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}
         run: |
           # Commit the updated PO files.
           git add docs/locales