diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index 39aea5d18..1f8a8ac87 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -4,7 +4,6 @@ on:
       test:
         required: false
         type: boolean
-    secrets: inherit
 jobs:
   images:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5d30578fb..7f826cdfc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
       bump:
         type: choice
         required: true
-        description: Bump version number    
+        description: Bump version number
         options: [major, minor, patch]
         default: patch
   pull_request:
@@ -21,14 +21,17 @@ jobs:
           git config --global user.email 64868532+iterative-olivaw@users.noreply.github.com
           git checkout -b bump/$(npm version ${{ github.event.inputs.bump }})
           git push --set-upstream origin --follow-tags HEAD
-          gh pr create --title "Bump version to $(git describe --tags)" --fill
+          gh pr create --title "Bump version to $(git describe --tags)" --body "Approve me 🤖"
+          gh pr merge --squash --auto
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
   release:
     if: github.event.pull_request.merged && startsWith(github.head_ref, 'bump/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - run: gh release create --generate-notes --draft {--target=,--title=CML\ ,}$(basename ${{ github.head_ref }})
+      - run:
+          gh release create --generate-notes {--title=CML\ ,}$(basename ${{
+          github.head_ref }})
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.ADMIN_GITHUB_TOKEN }}
diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml
index 4a74a2288..52c543c0d 100644
--- a/.github/workflows/test-deploy.yml
+++ b/.github/workflows/test-deploy.yml
@@ -2,8 +2,8 @@ name: Test & Deploy
 on:
   schedule:
     - cron: '0 8 * * 1' # M H d m w (Mondays at 8:00)
-  push:
-    tags: ['v*']
+  release:
+    types: [created]
   pull_request_target:
   workflow_dispatch:
 jobs:
@@ -48,7 +48,7 @@ jobs:
       - run: |
           pip install tensorboard
           pip install -I protobuf==3.20.1
-      - run: npm ci
+      - run: npm ci && npm install --global
       - run: npm run test
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -99,7 +99,7 @@ jobs:
           registry-url: https://registry.npmjs.org
       - run: npm install
       - run:
-          npm ${{ github.event_name == 'push' && 'publish' || 'publish
+          npm ${{ github.event_name == 'release' && 'publish' || 'publish
           --dry-run' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -121,11 +121,8 @@ jobs:
           cp build/cml-linux{-x64,}
           cp build/cml-macos{-x64,}
       - uses: softprops/action-gh-release@v1
-        if: github.event_name == 'push'
+        if: github.event_name == 'release'
         with:
-          name: CML ${{ steps.build.outputs.tag }}
-          draft: true
-          generate_release_notes: true
           files: |
             build/cml-alpine-arm64
             build/cml-alpine-x64
@@ -143,4 +140,5 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
   images:
     needs: packages
-    uses: .github/workflows/images.yml
+    secrets: inherit
+    uses: ./.github/workflows/images.yml
diff --git a/bin/legacy/link.test.js b/bin/legacy/link.test.js
index 58dfd09bb..891c84d8c 100644
--- a/bin/legacy/link.test.js
+++ b/bin/legacy/link.test.js
@@ -8,8 +8,8 @@ const commands = Object.keys(bin)
 describe('command-line interface tests', () => {
   for (const command of commands)
     test(`legacy cml-${command} behaves as the new cml ${command}`, async () => {
-      const legacyOutput = await exec(`npx --package=. cml-${command} --help`);
-      const newOutput = await exec(`npx --package=. cml ${command} --help`);
+      const legacyOutput = await exec(`cml-${command} --help`);
+      const newOutput = await exec(`cml ${command} --help`);
       expect(legacyOutput).toBe(newOutput);
     });
 });