diff --git a/.github/workflows/changelog-release-update.yml b/.github/workflows/changelog-release-update.yml
index c44f46ad..056c95fb 100644
--- a/.github/workflows/changelog-release-update.yml
+++ b/.github/workflows/changelog-release-update.yml
@@ -5,16 +5,14 @@ on:
   release:
     types: [released]
 
+permissions:
+  pull-requests: write
+  contents: write
+
 jobs:
   update:
     runs-on: ubuntu-latest
 
-    permissions:
-      # Give the default GITHUB_TOKEN write permission to commit and push the
-      # updated CHANGELOG back to the repository.
-      # https://github.blog/changelog/2023-02-02-github-actions-updating-the-default-github_token-permissions-to-read-only/
-      contents: write
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -28,9 +26,12 @@ jobs:
           heading-text: ${{ github.event.release.name }}
           release-notes: ${{ github.event.release.body }}
 
-      - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v5
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
         with:
-          branch: ${{ github.event.release.target_commitish }}
-          commit_message: Update CHANGELOG
-          file_pattern: CHANGELOG.md
+          branch: docs/changelog-update-${{ github.event.release.tag_name }}
+          title: '[Changelog] Update to ${{ github.event.release.tag_name }}'
+          labels: |
+            automated pr
+          add-paths: |
+            CHANGELOG.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4e22a48..1ec705c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -65,6 +65,7 @@ Keep it human-readable, your future self will thank you!
  - (ci): path ignore of docs for downstream ci
  - (ci): remove yaml anchor, unsupported by Github
  - ci: make python QA reusable
+ - ci: permissions on changelog updater
 
 ### Removed
  - Dependency on mlflow-export-import