diff --git a/README-maintainer b/README-maintainer
index fd28f9a4..b4244247 100644
--- a/README-maintainer
+++ b/README-maintainer
@@ -267,18 +267,15 @@ chmod 555 *.AppImage
   arguments. Create and push a signed tag. This should be run with
   HEAD pointing to the tip of master.
 
-git rev-parse master upstream/master @
+git rev-parse upstream/master @
 git tag -s release-qpdf-$version @ -m"qpdf $version"
 git push upstream release-qpdf-$version
 
-* In Azure Pipelines, retain the build that was used to generate the
-  release.
-
 * Create a github release after pushing the tag. `gcurl` is an alias
   that includes the auth token.
 
 # Create release
-TOKEN=$(cat ~/.github-token)
+TOKEN=$(qdata-show cred github-token)
 function gcurl() { curl -H "Authorization: token $TOKEN" ${1+"$@"}; }
 url=$(gcurl -s -XPOST https://api.github.com/repos/qpdf/qpdf/releases -d'{"tag_name": "release-qpdf-'$version'", "name": "qpdf '$version'", "draft": true}' | jq -r '.url')