diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ef7e88958..7326c74ad 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -493,7 +493,9 @@ jobs:
       - name: Commit and push version bump
         env:
           SOURCE_BRANCH: ${{ steps.source_branch.outputs.branch }}
-          GH_TOKEN: ${{ secrets.VERSION_BUMP_PR_TOKEN || github.token }}
+          # The organization disallows GITHUB_TOKEN from creating pull requests,
+          # so prefer a dedicated token and fall back to the existing repository PAT.
+          GH_TOKEN: ${{ secrets.VERSION_BUMP_PR_TOKEN || secrets.GH_PAT || github.token }}
           REF_NAME: ${{ github.ref_name }}
         run: |
           set -euo pipefail
@@ -576,11 +578,11 @@ jobs:
           set -e
 
           if [[ $pr_create_status -ne 0 ]]; then
-            echo "::warning::Pushed ${BUMP_BRANCH}, but could not create the version bump PR: ${pr_create_output}"
+            echo "::error::Pushed ${BUMP_BRANCH}, but could not create the version bump PR: ${pr_create_output}"
             if grep -q "GitHub Actions is not permitted to create or approve pull requests" <<< "$pr_create_output"; then
-              echo "::notice::Enable the repository setting that allows GitHub Actions to create pull requests, or add a VERSION_BUMP_PR_TOKEN secret with contents, pull requests, and workflows permissions."
+              echo "::notice::Add a VERSION_BUMP_PR_TOKEN or GH_PAT secret with contents, pull requests, and workflows permissions."
             fi
-            exit 0
+            exit 1
           fi
 
           PR_URL="$pr_create_output"
diff --git a/.sure-version b/.sure-version
index 8212b52e3..0ad2651e5 100644
--- a/.sure-version
+++ b/.sure-version
@@ -1 +1 @@
-0.7.3-alpha.3
+0.7.3-alpha.4
diff --git a/charts/sure/Chart.yaml b/charts/sure/Chart.yaml
index fc31187bf..daf4d1456 100644
--- a/charts/sure/Chart.yaml
+++ b/charts/sure/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: sure
 description: Official Helm chart for deploying the Sure Rails app (web + Sidekiq) on Kubernetes with optional HA PostgreSQL (CloudNativePG) and Redis.
 type: application
-version: 0.7.3-alpha.3
-appVersion: "0.7.3-alpha.3"
+version: 0.7.3-alpha.4
+appVersion: "0.7.3-alpha.4"
 
 kubeVersion: ">=1.25.0-0"