diff --git a/.github/workflows/dependabot_automerge_caller.yml b/.github/workflows/dependabot_automerge_caller.yml
index 782fc3a..dea265c 100644
--- a/.github/workflows/dependabot_automerge_caller.yml
+++ b/.github/workflows/dependabot_automerge_caller.yml
@@ -2,9 +2,11 @@ jobs:
   dependabot_automerge:
     name: Dependabot automerge
     permissions:
-      contents: write # required to merge the pull request
-      pull-requests: write # required to enable auto-merge on the pull request
-    uses: praw-dev/.github/.github/workflows/dependabot_automerge.yml@68c4e3402dc6c829ac9a1a787a663baabd21388b # v1.7.0
+      pull-requests: read # required by fetch-metadata; the merge uses an app token
+    secrets:
+      APP_ID: ${{ secrets.APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+    uses: praw-dev/.github/.github/workflows/dependabot_automerge.yml@ec52651e5b4e1de96c58ed3652e662588fb62dbb # v1.9.0
 name: Dependabot automerge
 on:
   pull_request: