diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 0b3a70e..b8ddebe 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -14,20 +14,24 @@ concurrency:
 jobs:
   create-nightly-tag:
     runs-on: ubuntu-latest
+    env:
+      HOMEBREW_TAP_APP_ID: ${{ secrets.HOMEBREW_TAP_APP_ID }}
+      HOMEBREW_TAP_APP_PRIVATE_KEY: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
     steps:
       - name: Generate token
         id: app-token
+        if: ${{ env.HOMEBREW_TAP_APP_ID != '' && env.HOMEBREW_TAP_APP_PRIVATE_KEY != '' }}
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
+          client-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
           private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: cli
+          repositories: ${{ github.event.repository.name }}
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
-          token: ${{ steps.app-token.outputs.token }}
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Create nightly tag
         run: |
diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 0000000..150bf47
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1,31 @@
+# CODEOWNERS for trace
+#
+# These owners will be the default owners for everything in the repo. Unless
+# a later match takes precedence, they will be requested for review when
+# someone opens a pull request.
+#
+# Format reference: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Global default
+* @GrayCodeAI/maintainers
+
+# CLI and core commands
+/cmd/            @GrayCodeAI/core-team
+
+# E2E tests and perf benchmarks
+/e2e/            @GrayCodeAI/core-team
+/perf/           @GrayCodeAI/core-team
+
+# Redaction (security-sensitive)
+/redact/         @GrayCodeAI/security-team
+
+# CI / release / build tooling
+/.github/        @GrayCodeAI/devops-team
+/Makefile        @GrayCodeAI/devops-team
+
+# Versioning + release artefacts
+/VERSION         @GrayCodeAI/maintainers
+/CHANGELOG.md    @GrayCodeAI/maintainers
+
+# Documentation
+*.md             @GrayCodeAI/docs-team