diff --git a/.github/workflows/validate-pipelines.yml b/.github/workflows/validate-pipelines.yml
index 22c46f0833..00688ec7df 100644
--- a/.github/workflows/validate-pipelines.yml
+++ b/.github/workflows/validate-pipelines.yml
@@ -50,6 +50,7 @@ jobs:
                 id_token_include_email: true
             - uses: getsentry/action-gocd-jsonnet@2a32414fa9e58a46d1afea9cbfa7b77a928678e2 # v1.1.1
               with:
+                go-version: "1.25"
                 jb-install: true
                 jsonnet-dir: gocd/templates
                 generated-dir: gocd/generated-pipelines
diff --git a/gocd/templates/bash/check-github.sh b/gocd/templates/bash/check-github.sh
index 891b2584ac..b3cda1f45a 100644
--- a/gocd/templates/bash/check-github.sh
+++ b/gocd/templates/bash/check-github.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-checks-githubactions-checkruns \
+checks-githubactions-checkruns2 \
   --timeout-mins 60 \
   getsentry/snuba \
   ${GO_REVISION_SNUBA_REPO} \
diff --git a/gocd/templates/pipelines/snuba-py.libsonnet b/gocd/templates/pipelines/snuba-py.libsonnet
index 43b8a3bf9e..7837aee955 100644
--- a/gocd/templates/pipelines/snuba-py.libsonnet
+++ b/gocd/templates/pipelines/snuba-py.libsonnet
@@ -160,8 +160,9 @@ local deploy_canary_stage(region) =
 function(region) {
   environment_variables: {
     SENTRY_REGION: region,
-    // Required for checkruns.
-    GITHUB_TOKEN: '{{SECRET:[devinfra-github][token]}}',
+    // Required for checkruns2.
+    GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}',
+    GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}',
     GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}',
   },
   lock_behavior: 'unlockWhenFinished',
diff --git a/gocd/templates/pipelines/snuba-rs.libsonnet b/gocd/templates/pipelines/snuba-rs.libsonnet
index 61d7fcd3d7..65462b1b29 100644
--- a/gocd/templates/pipelines/snuba-rs.libsonnet
+++ b/gocd/templates/pipelines/snuba-rs.libsonnet
@@ -136,8 +136,9 @@ local deploy_canary_stage(region) =
 function(region) {
   environment_variables: {
     SENTRY_REGION: region,
-    // Required for checkruns.
-    GITHUB_TOKEN: '{{SECRET:[devinfra-github][token]}}',
+    // Required for checkruns2.
+    GITHUB_APP_ID: '{{SECRET:[devinfra-github][app_id]}}',
+    GITHUB_APP_PRIVATE_KEY: '{{SECRET:[devinfra-github][private_key]}}',
     GOCD_ACCESS_TOKEN: '{{SECRET:[devinfra][gocd_access_token]}}',
   },
   lock_behavior: 'unlockWhenFinished',