diff --git a/.github/workflows/canary.yaml b/.github/workflows/canary.yaml
index d373598096..cc988a8496 100644
--- a/.github/workflows/canary.yaml
+++ b/.github/workflows/canary.yaml
@@ -10,6 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Publish Canary
     if: github.event.workflow_run.event == 'pull_request'
+    environment: canary-pr-npm
     steps:
       - name: Checkout repo
         uses: actions/checkout@v2
@@ -75,7 +76,7 @@ jobs:
       - name: Publish NPM package
         run: npm publish --ignore-scripts ./npmDist
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_CANARY_PR_PUBLISH_TOKEN }}
 
       - name: Add comment on PR
         uses: actions/github-script@v5
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ab6e6cc588..e97532e807 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -7,6 +7,9 @@ jobs:
     name: Deploy to `npm` branch
     needs: ci
     if: github.ref == 'refs/heads/main'
+    environment:
+      name: npm-branch
+      url: https://github.com/graphql/graphql-js/tree/npm
     uses: ./.github/workflows/deploy-artifact-as-branch.yml
     with:
       artifact_name: npmDist
@@ -17,6 +20,9 @@ jobs:
     name: Deploy to `deno` branch
     needs: ci
     if: github.ref == 'refs/heads/main'
+    environment:
+      name: deno-branch
+      url: https://github.com/graphql/graphql-js/tree/deno
     uses: ./.github/workflows/deploy-artifact-as-branch.yml
     with:
       artifact_name: denoDist