diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 361c47ae..c56b41ac 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -42,6 +42,13 @@ jobs:
     needs: npm
     runs-on: macos-latest
     steps:
+      # Ensure things are up to date
+      # Suggested by homebrew maintainers
+      # https://github.com/Homebrew/discussions/discussions/1532#discussioncomment-782633
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@master
+
       - uses: actions/checkout@v2
       - name: Configure git
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca8939af..62d307a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -58,6 +58,10 @@ VS Code v0.00.0
 - chore: cross-compile docker images with buildx #3166 @oxy
 - chore: update node to v14 #3458 @oxy
 
+### Development
+
+- fix(publish): update cdrci fork in brew-bump.sh #3468 @jsjoeio
+
 ## 3.10.2
 
 VS Code v1.56.1
diff --git a/ci/steps/brew-bump.sh b/ci/steps/brew-bump.sh
index 4e450025..ec0704cd 100755
--- a/ci/steps/brew-bump.sh
+++ b/ci/steps/brew-bump.sh
@@ -26,7 +26,14 @@ main() {
   git merge upstream/master
 
   echo "Pushing changes to cdrci/homebrew-core fork on GitHub"
-  git push origin master
+  # Source: https://serverfault.com/a/912788
+  # shellcheck disable=SC2016,SC2028
+  echo '#!/bin/sh\nexec echo "$HOMEBREW_GITHUB_API_TOKEN"' >"$HOME"/.git-askpass.sh
+  # Ensure it's executable since we just created it
+  chmod +x "$HOME/.git-askpass.sh"
+  # GIT_ASKPASS lets us use the password when pushing without revealing it in the process list
+  # See: https://serverfault.com/a/912788
+  GIT_ASKPASS="$HOME/.git-askpass.sh" git push https://cdr-oss@github.com/cdr-oss/homebrew-core.git --all
 
   # Find the docs for bump-formula-pr here
   # https://github.com/Homebrew/brew/blob/master/Library/Homebrew/dev-cmd/bump-formula-pr.rb#L18