diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index 6d42a47fe0..afab197c23 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -1,5 +1,8 @@
 name: Create Release PR
 on:
+  push:
+    branches:
+      - osun/fix-git-permission
   workflow_dispatch:
     inputs:
       version:
@@ -11,14 +14,16 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout repository code
-        uses: actions/checkout@v4
       - name: Get GitHub app token
         uses: actions/create-github-app-token@v1
         id: app_token
         with:
           app-id: ${{ env.APP_ID }}
           private-key: ${{ secrets.TOKEN_EXCHANGE_GH_APP_PRIVATE_KEY }}
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app_token.outputs.token }}
       - name: Set up Git name and email
         run: |
           git config --global user.email "251311+buf-release-bot[bot]@users.noreply.github.com"
@@ -26,6 +31,7 @@ jobs:
       - name: Create release PR
         run: bash ./make/buf/scripts/createreleasepr.bash
         env:
-          GH_TOKEN: ${{ steps.app_token.outputs.token }}
-          VERSION: ${{ github.event.inputs.version }}
+          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}
+          # VERSION: ${{ github.event.inputs.version }}
+          VERSION: 1.28.0
           WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_NOTIFICATION_WEBHOOK }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83212ec3d1..69b90a26de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## [Unreleased]
+## [v1.28.0] - 2023-11-10
 
 - Add lint rules for [protovalidate](https://github.com/bufbuild/protovalidate). `buf lint`
   will now verify that your protovalidate rules are valid. A single rule `PROTOVALIDATE` has been
@@ -973,7 +973,7 @@ buf check breaking proto --against .git#branch=master,subdir=proto
 
 Initial beta release.
 
-[Unreleased]: https://github.com/bufbuild/buf/compare/v1.27.2...HEAD
+[v1.28.0]: https://github.com/bufbuild/buf/compare/v1.27.2...v1.28.0
 [v1.27.2]: https://github.com/bufbuild/buf/compare/v1.27.1...v1.27.2
 [v1.27.1]: https://github.com/bufbuild/buf/compare/v1.27.0...v1.27.1
 [v1.27.0]: https://github.com/bufbuild/buf/compare/v1.26.1...v1.27.0
diff --git a/make/buf/scripts/createreleasepr.bash b/make/buf/scripts/createreleasepr.bash
index 5128722c4a..5b5afcf85c 100755
--- a/make/buf/scripts/createreleasepr.bash
+++ b/make/buf/scripts/createreleasepr.bash
@@ -8,7 +8,7 @@ cd "${DIR}"
 # We already have set -u, but want to fail early if a required variable is not set.
 : ${WEBHOOK_URL}
 # However, if you are already logged in for GitHub CLI locally, you can remove this line when running it locally.
-: ${GH_TOKEN}
+# : ${GH_TOKEN}
 
 if [[ "${VERSION}" == v* ]]; then
   echo "error: VERSION ${VERSION} must not start with 'v'" >&2
diff --git a/private/buf/bufcli/bufcli.go b/private/buf/bufcli/bufcli.go
index d5e66b6747..05a909cded 100644
--- a/private/buf/bufcli/bufcli.go
+++ b/private/buf/bufcli/bufcli.go
@@ -65,7 +65,7 @@ import (
 
 const (
 	// Version is the CLI version of buf.
-	Version = "1.27.3-dev"
+	Version = "1.28.0"
 
 	inputHTTPSUsernameEnvKey      = "BUF_INPUT_HTTPS_USERNAME"
 	inputHTTPSPasswordEnvKey      = "BUF_INPUT_HTTPS_PASSWORD"