Your team runs a nightly automation script hosted on an Azure VM that clones several repositories across two GitHub organizations, opens issues, and updates commit statuses. Currently it authenticates with a developer's classic personal access token, which recently expired and broke all automation. You need an approach that scopes access to only the required repositories, is not tied to any individual employee, and provides short-lived tokens that are automatically rotated. What should you implement?