diff --git a/.github/workflows/notify-postman.yml b/.github/workflows/notify-postman.yml
index 5c5fa1e..c9f2d4c 100644
--- a/.github/workflows/notify-postman.yml
+++ b/.github/workflows/notify-postman.yml
@@ -31,9 +31,10 @@ jobs:
   notify:
     runs-on: ubuntu-latest
     steps:
-      # Same identity cb-sdk-gen releases specs with (chargebee-sdk-release-bot),
-      # so no separate personal access token needs minting or rotating: the
-      # installation token below lives for an hour.
+      # Dedicated GitHub App, installed on chargebee/cb-openapi-generator alone
+      # with Contents: write — the single permission repository_dispatch needs.
+      # No personal access token to mint or rotate: the installation token
+      # below lives for an hour.
       #
       # continue-on-error is what keeps this workflow failing soft. Without it
       # this step hard-fails when the private key is absent or malformed, before
@@ -46,8 +47,8 @@ jobs:
         continue-on-error: true
         uses: actions/create-github-app-token@v1
         with:
-          app-id: ${{ secrets.CB_SDK_BOT_APP_ID }}
-          private-key: ${{ secrets.CB_SDK_BOT_PEM_KEY }}
+          app-id: ${{ secrets.POSTMAN_DISPATCH_APP_ID }}
+          private-key: ${{ secrets.POSTMAN_DISPATCH_PEM_KEY }}
           owner: ${{ github.repository_owner }}
           repositories: cb-openapi-generator
           permission-contents: write