diff --git a/.github/workflows-disabled/ts-sdk.yml b/.github/workflows-disabled/ts-sdk.yml
deleted file mode 100644
index b57941bd..00000000
--- a/.github/workflows-disabled/ts-sdk.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Release TypeScript SDK
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "The version of the SDKs that you would like to release"
-        required: true
-        type: string
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
-
-      - name: Setup node
-        uses: actions/setup-node@v4
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-
-      - name: Download Fern
-        run: pnpm add -g fern-api@5.65.3
-
-      - name: Release SDKs
-        env:
-          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
-          FERN_NPM_TOKEN: ${{ secrets.FERN_NPM_TOKEN }}
-        run: |
-          fern generate --group ts-sdk --version ${{ inputs.version }} --log-level debug
diff --git a/.github/workflows/ts-sdk.yml b/.github/workflows/ts-sdk.yml
new file mode 100644
index 00000000..ce43655d
--- /dev/null
+++ b/.github/workflows/ts-sdk.yml
@@ -0,0 +1,56 @@
+name: Release TypeScript SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The version of the SDKs that you would like to release"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    # FERN_TOKEN is an environment secret; only runs from main can reach it.
+    environment: main
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Download Fern
+        run: pnpm add -g fern-api@5.65.3
+
+      - name: Validate version input
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "version must look like 7.0.5 or 7.0.5-beta.0, got: $VERSION"
+            exit 1
+          fi
+
+      - name: Release SDKs
+        env:
+          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
+          VERSION: ${{ inputs.version }}
+        run: fern generate --group ts-sdk --version "$VERSION" --log-level debug
diff --git a/fern/generators.yml b/fern/generators.yml
index 3a87074b..bce83257 100644
--- a/fern/generators.yml
+++ b/fern/generators.yml
@@ -36,7 +36,6 @@ groups:
         output:
           location: npm
           package-name: intercom-client
-          token: ${FERN_NPM_TOKEN}
         github:
           repository: intercom/intercom-node
           mode: pull-request