diff --git a/.github/workflows/go-ossf-slsa3-publish.yml b/.github/workflows/go-ossf-slsa3-publish.yml
index e918415..4309ae5 100644
--- a/.github/workflows/go-ossf-slsa3-publish.yml
+++ b/.github/workflows/go-ossf-slsa3-publish.yml
@@ -31,6 +31,16 @@ jobs:
         with:
           go-version-file: './go.mod'
       - run: go test -v ./...
+  get-bot-token:
+    runs-on: ubuntu-latest
+    steps:
+        - name: Get Token
+          id: get_workflow_token
+          uses: peter-murray/workflow-application-token-action@v3
+          with:
+            application_id: ${{ secrets.BOT_APP_ID }}
+            application_private_key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+            organization: eat-pray-ai
   # Generate ldflags dynamically.
   # Optional: only needed for ldflags.
   args:
@@ -91,6 +101,8 @@ jobs:
           - darwin-arm64
           - windows-amd64.exe
           - windows-arm64.exe
+    env:
+      a: "b"
     steps:
       - name: Download artifact
         uses: actions/download-artifact@v4
@@ -100,3 +112,15 @@ jobs:
         uses: actions/attest-build-provenance@v1
         with:
           subject-path: '${{ github.workspace }}/yutu-${{ matrix.artifact }}'
+
+  winget-release:
+    needs: [build]
+    runs-on: windows-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: vedantmgoyal2009/winget-releaser@v2
+        with:
+          identifier: eat-pray-ai.yutu
+          installers-regex: '\.exe$' # Only .exe files
+          version: ${{ github.event.release.tag_name }}
+          token: ${{ secrets.RELEASE_PAT }}
diff --git a/.github/workflows/winget-release.yml b/.github/workflows/winget-release.yml
deleted file mode 100644
index 44f2e68..0000000
--- a/.github/workflows/winget-release.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: Publish to WinGet
-on:
-  release:
-    types: [released]
-jobs:
-  publish:
-    runs-on: windows-latest
-    steps:
-      - uses: vedantmgoyal2009/winget-releaser@v2
-        with:
-          identifier: eat-pray-ai.yutu
-          installers-regex: '\.exe$' # Only .exe files
-          version: ${{ github.event.release.tag_name }}
-          token: ${{ secrets.RELEASE_PAT }}