diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..161bccbe
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,10 @@
+# actionlint validates action inputs against a bundled schema snapshot.
+# The snapshot in the pinned actionlint version predates the app-id -> client-id
+# rename in actions/create-github-app-token, so it wrongly flags client-id as
+# unknown and app-id as required. The live action supports client-id (app-id is
+# deprecated). Remove this ignore once actionlint's bundled data catches up.
+paths:
+  .github/workflows/dispatch-release.yaml:
+    ignore:
+      - 'input "client-id" is not defined in action "actions/create-github-app-token'
+      - 'missing input "app-id" which is required by action "actions/create-github-app-token'
diff --git a/.github/workflows/dispatch-release.yaml b/.github/workflows/dispatch-release.yaml
index 787bf50c..4bbda25a 100644
--- a/.github/workflows/dispatch-release.yaml
+++ b/.github/workflows/dispatch-release.yaml
@@ -97,7 +97,7 @@ jobs:
         id: generate_token
         uses: 'actions/create-github-app-token@v3'
         with:
-          app-id: ${{ secrets.ACTIONS_RELEASE_APP_ID }}
+          client-id: ${{ secrets.ACTIONS_RELEASE_CLIENT_ID }}
           private-key: ${{ secrets.ACTIONS_RELEASE_APP_PRIVATE_KEY }}
 
       - name: 'Create branch and Pull Request'
diff --git a/.github/workflows/universal_workflow_light.yaml b/.github/workflows/universal_workflow_light.yaml
index 24ba4be9..e84c6761 100644
--- a/.github/workflows/universal_workflow_light.yaml
+++ b/.github/workflows/universal_workflow_light.yaml
@@ -343,8 +343,10 @@ jobs:
 
       - name: 'Run composer for each module'
         shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          git clone --depth=1 --quiet --branch v2.0.0 https://github.com/joernott/load_testplan.git load_testplan
+          git clone --depth=1 --quiet --branch v2.0.0 "https://x-access-token:${GH_TOKEN}@github.com/joernott/load_testplan.git" load_testplan
           LOAD_TESTPLAN=$(find ./load_testplan -iname 'main-linux-amd64-*')
           chmod a+x "${LOAD_TESTPLAN}"
           PREFIXES=$(echo '${{steps.iltp.outputs.runscript_matrix_script}}'|tr ',' '\n'|tr -d '[]" '|sed -e 's|-|_|g' -e 's|:.*||'|sort|uniq)
diff --git a/prepare_shop/action.yaml b/prepare_shop/action.yaml
index f51e8d0c..031d247b 100644
--- a/prepare_shop/action.yaml
+++ b/prepare_shop/action.yaml
@@ -195,7 +195,12 @@ runs:
         REF='${{ inputs.git_sdk_ref }}'
         git init
         git config advice.detachedHead false
-        git remote add origin https://github.com/${{ inputs.git_sdk_repository }}.git
+        if [ -n "${{ inputs.enterprise_github_token }}" ]; then
+          URL="https://oxidci:${{ inputs.enterprise_github_token }}@github.com/${{ inputs.git_sdk_repository }}.git"
+        else
+          URL="https://github.com/${{ inputs.git_sdk_repository }}.git"
+        fi
+        git remote add origin "${URL}"
         git -c protocol.version=2 fetch \
           --no-tags --prune --no-recurse-submodules \
           --filter=blob:none --depth=1 \