diff --git a/.github/workflows/agent.yml b/.github/workflows/agent.yml
index 8d761f8f..fc3033e5 100644
--- a/.github/workflows/agent.yml
+++ b/.github/workflows/agent.yml
@@ -170,14 +170,6 @@ jobs:
       with:
         go-version: '1.24.0'
         check-latest: true
-    - uses: actions/checkout@v2
-      with:
-        # You should create a personal access token and store it in your repository
-        token: ${{ secrets.CI_USER_TOKEN }}
-        repository: 'optimizely/travisci-tools'
-        path: 'home/runner/travisci-tools'
-        ref: 'master'
-        persist-credentials: false
     - name: Get the version
       id: get_version
       run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
@@ -190,21 +182,13 @@ jobs:
         echo "APP_VERSION=${TAG#v}" >> $GITHUB_ENV
         echo "RELEASE_TAG=${TAG}" >> $GITHUB_ENV
         echo "TRAVIS_BUILD_DIR=${{ steps.get_workspace.outputs.WORKSPACE }}" >> $GITHUB_ENV
-    - name: Upload and publish draft
-      env:
-        HOME: 'home/runner'
-      run: |
-        # installs hub to ~/bin
-        $HOME/travisci-tools/release_github/install_hub.sh
-        echo "$HOME/bin:$HOME/travisci-tools/release_github" >> $GITHUB_PATH
     - name: run make
       env:
         TRAVIS_OS_NAME: 'linux'
       run: |
         make -e setup build
     - name: create and upload packages
-      env: 
-        HOME: 'home/runner'
+      env:
         GITHUB_TOKEN: ${{ secrets.CI_USER_TOKEN }}
         TRAVIS_OS_NAME: 'linux'
         DOCKERHUB_PASS: ${{ secrets.DOCKERHUB_PASS }}
@@ -212,9 +196,8 @@ jobs:
       run: |
         # now we're going to create packages & upload packages
         ./scripts/ci_create_packages.sh && ./scripts/ci_upload_packages.sh
-        # create the github release (draft)
-        cp $HOME/travisci-tools/release_github/release_github_v2.sh .
-        ./release_github_v2.sh "$APP_VERSION"  
+        # create the github release (draft) if it doesn't already exist
+        ./scripts/ci_create_github_release.sh "$RELEASE_TAG"
         # attach generate_secret to the github release
         ./scripts/ci_build_generate_secret.sh && ./scripts/ci_attach_generate_secret.sh
 
@@ -244,14 +227,6 @@ jobs:
       with:
         go-version: '1.24.0'
         check-latest: true
-    - uses: actions/checkout@v2
-      with:
-        # You should create a personal access token and store it in your repository
-        token: ${{ secrets.CI_USER_TOKEN }}
-        repository: 'optimizely/travisci-tools'
-        path: 'home/runner/travisci-tools'
-        ref: 'master'
-        persist-credentials: false
     - name: Get the version
       id: get_version
       run: echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
@@ -259,14 +234,6 @@ jobs:
       run: |
         TAG=${{ steps.get_version.outputs.VERSION }}
         echo "APP_VERSION=${TAG#v}" >> $GITHUB_ENV
-    - name: Upload and publish draft
-      shell: bash
-      env:
-        HOME: 'home/runner'
-      run: |
-        # installs hub to ~/bin
-        $HOME/travisci-tools/release_github/install_hub.sh
-        # echo "$HOME/bin:$HOME/travisci-tools/slack" >> $GITHUB_PATH
     - name: run script
       env:
         GITHUB_TOKEN: ${{ secrets.CI_USER_TOKEN }}
@@ -276,7 +243,8 @@ jobs:
       id: script
       shell: bash
       run: |
-        hub release download $(git describe --abbrev=0 --tags) -i '*-${{ matrix.TARGET }}-*'
+        # gh is preinstalled on GitHub-hosted runners; replaces the deprecated hub CLI
+        gh release download $(git describe --abbrev=0 --tags) -p '*-${{ matrix.TARGET }}-*'
         tar xvfz generate_secret-${{ matrix.TARGET }}-${APP_VERSION}.tar.gz -C /tmp
         /tmp/generate_secret
     # TODO: add step to publish outcome on teams.
diff --git a/scripts/ci_attach_generate_secret.sh b/scripts/ci_attach_generate_secret.sh
index f4035343..6d73ed8b 100755
--- a/scripts/ci_attach_generate_secret.sh
+++ b/scripts/ci_attach_generate_secret.sh
@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
 set -e
 
-hub release edit "$RELEASE_TAG" -m "" \
-  -a "/tmp/output_packages/generate_secret-linux-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for Linux 64-bit" \
-  -a "/tmp/output_packages/generate_secret-darwin-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for MacOS 64-bit" \
-  -a "/tmp/output_packages/generate_secret-windows-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for Windows 64-bit"
+# Attaches the generate_secret binaries to the GitHub release for $RELEASE_TAG.
+# Uses `gh` (preinstalled on GitHub-hosted runners) instead of the deprecated `hub` CLI.
+# `gh release upload` supports per-asset display labels via the "path#label" syntax.
+gh release upload "$RELEASE_TAG" --clobber \
+  "/tmp/output_packages/generate_secret-linux-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for Linux 64-bit" \
+  "/tmp/output_packages/generate_secret-darwin-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for MacOS 64-bit" \
+  "/tmp/output_packages/generate_secret-windows-amd64-$APP_VERSION.tar.gz#generate_secret $APP_VERSION for Windows 64-bit"
diff --git a/scripts/ci_create_github_release.sh b/scripts/ci_create_github_release.sh
new file mode 100755
index 00000000..bc76c110
--- /dev/null
+++ b/scripts/ci_create_github_release.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# Creates a draft GitHub release for the given tag, using the latest
+# CHANGELOG.md entry as the release description.
+#
+# This is a `gh`-based replacement for travisci-tools/release_github/release_github_v2.sh,
+# which relied on the deprecated `hub` CLI. `gh` is preinstalled on GitHub-hosted runners.
+#
+# Run this in the same directory where CHANGELOG.md lives.
+# grep -P below is GNU grep specific, so this is meant to run on Linux.
+
+CHANGELOG="CHANGELOG.md"
+
+# set to true for debugging
+debug=false
+
+if [ $# -ne 1 ]; then
+  echo "example: $0 v3.1.1"
+  exit 1
+fi
+
+# the tag being released, e.g. v4.6.0
+GIT_TAG="$1"
+
+# VERSION is the git tag with the "v" prefix removed
+VERSION=${GIT_TAG#v}
+
+# The release is often already created (the tag push that triggers CI usually
+# comes from a GitHub release created in the UI). In that case there is nothing
+# to create -- just let the caller move on to uploading assets.
+if gh release view "${GIT_TAG}" >/dev/null 2>&1; then
+  echo "Release ${GIT_TAG} already exists; skipping creation."
+  exit 0
+fi
+
+if [[ ! -f "${CHANGELOG}" ]]; then
+  echo "ERROR: ${CHANGELOG} not found in $(pwd)."
+  exit 1
+fi
+
+# check that CHANGELOG.md has been updated
+# (first version entry in the changelog should match our VERSION argument)
+NEW_VERSION_CHECK=$(grep -P '^## \[\d+\.\d+\.\d+\]' "${CHANGELOG}" | cut -d[ -f2 | cut -d] -f1 | awk 'NR==1')
+
+$debug && echo "NEW_VERSION_CHECK $NEW_VERSION_CHECK"
+$debug && echo "VERSION $VERSION"
+
+if [[ "${NEW_VERSION_CHECK}" != "${VERSION}" ]]; then
+  echo "ERROR: ${CHANGELOG} has not been updated yet."
+  exit 1
+fi
+
+NEW_VERSION=$(grep -P '^## \[\d+\.\d+\.\d+\]' "${CHANGELOG}" | awk 'NR==1' | sed -e 's/\[/\\\[/' | sed -e 's/\]/\\\]/')
+LAST_VERSION=$(grep -P '^## \[\d+\.\d+\.\d+\]' "${CHANGELOG}" | awk 'NR==2' | sed -e 's/\[/\\\[/' | sed -e 's/\]/\\\]/')
+
+DESCRIPTION=$(awk "/^${NEW_VERSION}$/,/^${LAST_VERSION:-nothingmatched}$/" "${CHANGELOG}" | grep -v "^${LAST_VERSION:-nothingmatched}$")
+
+$debug && echo "NEW_VERSION $NEW_VERSION"
+$debug && echo "LAST_VERSION $LAST_VERSION"
+$debug && echo "DESCRIPTION $DESCRIPTION"
+
+# Write the notes to a temp file and pass via --notes-file. This avoids the shell
+# re-parsing backticks / $ that can appear in changelog bodies (which --notes would).
+NOTES_FILE=$(mktemp)
+trap 'rm -f "${NOTES_FILE}"' EXIT
+printf '%s\n' "${DESCRIPTION}" > "${NOTES_FILE}"
+
+# --draft creates a draft release; the tag already exists (release is triggered by the tag push)
+gh release create "${GIT_TAG}" --draft --title "Release ${VERSION}" --notes-file "${NOTES_FILE}"