diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index c22b176..e0c109b 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -16,6 +16,8 @@ concurrency:
 jobs:
   generate:
     runs-on: ubuntu-latest
+    # TOKENLIST_SECRET lives in this environment, which only main may use.
+    environment: publish
     permissions:
       contents: write
     steps: