diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index 1600e9e93..bc342e51e 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -57,7 +57,7 @@ jobs:
           cache: "pnpm"
 
       - name: Setup EAS
-        uses: expo/expo-github-action@4479f9c12e08b76bb8a6ae00a31544a13d3b3d68 # v8
+        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
@@ -81,7 +81,8 @@ jobs:
   # Auto-promote the freshly built production binaries. Only runs when the build
   # job waited for completion (otherwise there is no finished build to submit).
   promote:
-    permissions: {}
+    permissions:
+      contents: read
     needs: build
     if: ${{ inputs.profile == 'production' && inputs.wait }}
     uses: ./.github/workflows/mobile-promote.yml
diff --git a/.github/workflows/mobile-promote.yml b/.github/workflows/mobile-promote.yml
index c55d44943..8f8e024d7 100644
--- a/.github/workflows/mobile-promote.yml
+++ b/.github/workflows/mobile-promote.yml
@@ -77,7 +77,7 @@ jobs:
           cache: "pnpm"
 
       - name: Setup EAS
-        uses: expo/expo-github-action@4479f9c12e08b76bb8a6ae00a31544a13d3b3d68 # v8
+        uses: expo/expo-github-action@c7b66a9c327a43a8fa7c0158e7f30d6040d2481e # v8
         with:
           eas-version: latest
           token: ${{ secrets.EXPO_TOKEN }}
diff --git a/apps/mobile/eas.json b/apps/mobile/eas.json
index 979d49a2d..dd2661104 100644
--- a/apps/mobile/eas.json
+++ b/apps/mobile/eas.json
@@ -26,7 +26,9 @@
   },
   "submit": {
     "production": {
-      "ios": {},
+      "ios": {
+        "ascAppId": "6762366098"
+      },
       "android": {
         "track": "internal"
       }