diff --git a/scripts/lib.sh b/scripts/lib.sh
index 78ec22d503fbf..e245fb4ab8cc7 100644
--- a/scripts/lib.sh
+++ b/scripts/lib.sh
@@ -134,18 +134,22 @@ requiredenvs() {
 }
 
 gh_auth() {
-	local fail=0
-	if [[ "${CODER:-}" == "true" ]]; then
-		if ! output=$(coder external-auth access-token github 2>&1); then
-			log "ERROR: Could not authenticate with GitHub."
-			log "$output"
-			fail=1
+	if [[ -z ${GITHUB_TOKEN:-} ]]; then
+		if [[ -n ${GH_TOKEN:-} ]]; then
+			export GITHUB_TOKEN=${GH_TOKEN}
+		elif [[ ${CODER:-} == true ]]; then
+			if ! output=$(coder external-auth access-token github 2>&1); then
+				# TODO(mafredri): We could allow checking `gh auth token` here.
+				log "${output}"
+				error "Could not authenticate with GitHub using Coder external auth."
+			else
+				export GITHUB_TOKEN=${output}
+			fi
+		elif token="$(gh auth token --hostname github.com 2>/dev/null)"; then
+			export GITHUB_TOKEN=${token}
 		else
-			GITHUB_TOKEN=$(coder external-auth access-token github)
-			export GITHUB_TOKEN
+			error "GitHub authentication is required to run this command, please set GITHUB_TOKEN or run 'gh auth login'."
 		fi
-	else
-		log "Please authenticate gh CLI by running 'gh auth login'"
 	fi
 }
 
diff --git a/scripts/release/main.go b/scripts/release/main.go
index 919205b76db65..8eaeb20825a92 100644
--- a/scripts/release/main.go
+++ b/scripts/release/main.go
@@ -62,9 +62,9 @@ func main() {
 				Value:       serpent.BoolOf(&r.debug),
 			},
 			{
-				Flag:        "gh-token",
+				Flag:        "github-token",
 				Description: "GitHub personal access token.",
-				Env:         "GH_TOKEN",
+				Env:         "GITHUB_TOKEN",
 				Value:       serpent.StringOf(&r.ghToken),
 			},
 			{
@@ -245,7 +245,7 @@ func (r *releaseCommand) promoteVersionToStable(ctx context.Context, inv *serpen
 	updatedNewStable.Prerelease = github.Bool(false)
 	updatedNewStable.Draft = github.Bool(false)
 	if !r.dryRun {
-		_, _, err = client.Repositories.EditRelease(ctx, owner, repo, newStable.GetID(), newStable)
+		_, _, err = client.Repositories.EditRelease(ctx, owner, repo, newStable.GetID(), updatedNewStable)
 		if err != nil {
 			return xerrors.Errorf("edit release failed: %w", err)
 		}
@@ -268,6 +268,10 @@ func cloneRelease(r *github.RepositoryRelease) *github.RepositoryRelease {
 //
 //	> ## Stable (since April 23, 2024)
 func addStableSince(date time.Time, body string) string {
+	// Protect against adding twice.
+	if strings.Contains(body, "> ## Stable (since") {
+		return body
+	}
 	return fmt.Sprintf("> ## Stable (since %s)\n\n", date.Format("January 02, 2006")) + body
 }
 
diff --git a/scripts/release/main_internal_test.go b/scripts/release/main_internal_test.go
index 74a6d46d05c8a..d5d10706683a2 100644
--- a/scripts/release/main_internal_test.go
+++ b/scripts/release/main_internal_test.go
@@ -131,12 +131,19 @@ func Test_addStableSince(t *testing.T) {
 	date := time.Date(2024, time.April, 23, 0, 0, 0, 0, time.UTC)
 	body := "## Changelog"
 
-	expected := "> ## Stable (since April 23, 2024)\n\n## Changelog"
-	result := addStableSince(date, body)
+	want := "> ## Stable (since April 23, 2024)\n\n## Changelog"
+	got := addStableSince(date, body)
 
-	if diff := cmp.Diff(expected, result); diff != "" {
+	if diff := cmp.Diff(want, got); diff != "" {
 		require.Fail(t, "addStableSince() mismatch (-want +got):\n%s", diff)
 	}
+
+	// Test that it doesn't add twice.
+	got = addStableSince(date, got)
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		require.Fail(t, "addStableSince() mismatch (-want +got):\n%s", diff, "addStableSince() should not add twice")
+	}
 }
 
 func Test_release_autoversion(t *testing.T) {
diff --git a/scripts/release_promote_stable.sh b/scripts/release_promote_stable.sh
index 33b55d3855d41..1ac0f8318d749 100755
--- a/scripts/release_promote_stable.sh
+++ b/scripts/release_promote_stable.sh
@@ -4,6 +4,9 @@ set -euo pipefail
 # shellcheck source=scripts/lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
+# Make sure GITHUB_TOKEN is set for the release command.
+gh_auth
+
 # This script is a convenience wrapper around the release promote command.
 #
 # Sed hack to make help text look like this script.