diff --git a/.github/labeler.yml b/.github/labeler.yml
index 3ff3fe4..c00d8f6 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,8 +1,12 @@
+ci:
+  - .dependabot/*
+  - .github/workflows/*
+
 documentation:
   - docs/**/*
   - .github/*
   - ./*.md
 
-ci:
-  - .dependabot/*
-  - .github/workflows/*
+terraform:
+  - examples/**/*.tf
+  - ./*.tf
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 08c71cd..969c3da 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -16,9 +16,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
+      ARM_CLIENT_ID: "${{ secrets.AZURE_CLIENT_ID }}"
+      ARM_SKIP_PROVIDER_REGISTRATION: true
+      ARM_SUBSCRIPTION_ID: "${{ secrets.AZURE_SUBSCRIPTION_ID }}"
+      ARM_TENANT_ID: "${{ secrets.AZURE_TENANT_ID }}"
+      ARM_USE_OIDC: true
       TFDIR: .
+      TF_VAR_rg_name: github-oidc
       TF_VAR_subnet_ids: '["test"]'
-      TF_VAR_workspace_name: rover
       TFVER: 1.1.2 # Rover uses Terraform 1.1.2, so we need to use the same version for the plan file
     steps:
       - name: Generate token
diff --git a/.github/workflows/template-sync.yml b/.github/workflows/template-sync.yml
index 334c902..63e00e8 100644
--- a/.github/workflows/template-sync.yml
+++ b/.github/workflows/template-sync.yml
@@ -11,15 +11,22 @@ jobs:
   repo-sync:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: actions-template-sync
         uses: AndreasAugustin/actions-template-sync@v0.6.0-draft
         with:
-          github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}
           source_repo_path: ventx/stackx-template-terraform
           pr_labels: chore,template-sync
           pr_title: "chore: upstream merge template repository"
diff --git a/.github/workflows/test-weekly.yml b/.github/workflows/test-weekly.yml
index b3514a3..14cfa86 100644
--- a/.github/workflows/test-weekly.yml
+++ b/.github/workflows/test-weekly.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Configure AWS credentials
         if: ${{ env.AWS_DEFAULT_REGION }}