diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acef03e8108..3935526826c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,13 +33,14 @@ jobs:
             NFPM_DEFAULT_PASSPHRASE=packages-gpg:passphrase
 
       - name: write-key
-        run: printf "%s" "$NFPM_SIGNING_KEY" > $NFPM_SIGNING_KEY_FILE
+        run: printenv NFPM_SIGNING_KEY > $NFPM_SIGNING_KEY_FILE
 
       - name: test release
         run: make release-snapshot
 
       - name: test deb package
         run: |
+          # podman is simpler to make it work with systemd inside containers
           podman run -d --name systemd-debian --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro jrei/systemd-debian:12
           podman cp ./dist/tempo_*_linux_amd64.deb systemd-debian:.
           podman cp ./tools/packaging/verify-deb-install.sh systemd-debian:.
@@ -54,7 +55,10 @@ jobs:
           podman cp ./tools/packaging/verify-rpm-install.sh systemd-centos:.
           podman cp ./tools/packaging/wait-for-ready.sh systemd-centos:.
           podman exec systemd-centos ./verify-rpm-install.sh
+          podman rm -f systemd-centos
 
       - name: release
         if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: make release