diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index aa9e8d78..3093c306 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -3,6 +3,10 @@
 name: "Post Dependabot Actions"
 on: pull_request
 
+# https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
+permissions:
+  contents: write
+
 jobs:
   Install:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index db96a53f..c5a165f3 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -14,7 +14,6 @@ jobs:
       - uses: google-github-actions/release-please-action@v2
         id: release
         with:
-          package-name: conventional-test
           release-type: node
           # If you change changelog-types be sure to also update commitlintrc.js
           changelog-types: >
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 955ad7db..b5d34290 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+### [2.9.1](https://www.github.com/npm/template-oss/compare/v2.9.0...v2.9.1) (2022-03-02)
+
+
+### Bug Fixes
+
+* dependabot permissions ([#71](https://www.github.com/npm/template-oss/issues/71)) ([28396cf](https://www.github.com/npm/template-oss/commit/28396cfa6cbbddc375bd9da49d685b9c4dc2b790))
+
+## [2.9.0](https://www.github.com/npm/template-oss/compare/v2.8.1...v2.9.0) (2022-03-01)
+
+
+### Features
+
+* add release-please workflow to workspace repo files ([#58](https://www.github.com/npm/template-oss/issues/58)) ([ad4be0d](https://www.github.com/npm/template-oss/commit/ad4be0d5100fa688a1181579f4146f075cded8d0))
+
+
+### Dependencies
+
+* bump @npmcli/fs from 1.1.1 to 2.0.1 ([#60](https://www.github.com/npm/template-oss/issues/60)) ([ecee70c](https://www.github.com/npm/template-oss/commit/ecee70cbd59541c580f76720cc2dfefb1f417603))
+
 ### [2.8.1](https://www.github.com/npm/template-oss/compare/v2.8.0...v2.8.1) (2022-02-23)
 
 
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index aa9e8d78..3093c306 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -3,6 +3,10 @@
 name: "Post Dependabot Actions"
 on: pull_request
 
+# https://docs.github.com/en/rest/overview/permissions-required-for-github-apps
+permissions:
+  contents: write
+
 jobs:
   Install:
     runs-on: ubuntu-latest
diff --git a/lib/content/release-please-workspace.yml b/lib/content/release-please-workspace.yml
new file mode 100644
index 00000000..077e33be
--- /dev/null
+++ b/lib/content/release-please-workspace.yml
@@ -0,0 +1,29 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Node Workspace Release Please %%pkgname%%
+
+on:
+  push:
+    paths:
+      - %%pkgpath%%/**
+    branches:
+      - release-next
+      - latest
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: google-github-actions/release-please-action@v2
+        id: release
+        with:
+          release-type: node
+          monorepo-tags: true
+          path: %%pkgpath%%/**        
+          # If you change changelog-types be sure to also update commitlintrc.js
+          changelog-types: >
+            [{"type":"feat","section":"Features","hidden":false},
+            {"type":"fix","section":"Bug Fixes","hidden":false},
+            {"type":"docs","section":"Documentation","hidden":false},
+            {"type":"deps","section":"Dependencies","hidden":false},
+            {"type":"chore","hidden":true}]
diff --git a/lib/content/release-please.yml b/lib/content/release-please.yml
index db96a53f..c5a165f3 100644
--- a/lib/content/release-please.yml
+++ b/lib/content/release-please.yml
@@ -14,7 +14,6 @@ jobs:
       - uses: google-github-actions/release-please-action@v2
         id: release
         with:
-          package-name: conventional-test
           release-type: node
           # If you change changelog-types be sure to also update commitlintrc.js
           changelog-types: >
diff --git a/lib/postinstall/copy-content.js b/lib/postinstall/copy-content.js
index 939755c1..084cc7e5 100644
--- a/lib/postinstall/copy-content.js
+++ b/lib/postinstall/copy-content.js
@@ -27,9 +27,13 @@ const repoFiles = {
   '.github/workflows/release-please.yml': './release-please.yml',
 }
 
-// currently no workspace moduleFiles
-// const workspaceContent = {}
-// const workspaceRootContent = {}
+// currently no workspace module files
+// const workspaceModuleFiles = {}
+
+const workspaceRepoFiles = {
+  '.github/workflows/release-please-%%pkgfsname%%.yml': './release-please-workspace.yml',
+  '.github/workflows/ci-%%pkgfsname%%.yml': './ci-workspace.yml',
+}
 
 const filesToDelete = [
   // remove any eslint config files that aren't local to the project
@@ -43,10 +47,25 @@ const defaultConfig = {
   windowsCI: true,
 }
 
-const copyFiles = async (targetDir, files) => {
+const findReplace = (str, replace = {}) => {
+  for (const [f, r] of Object.entries(replace)) {
+    str = str.replace(new RegExp(f, 'g'), r)
+  }
+  return str
+}
+
+const copyFile = async (source, target, replacements) => {
+  if (replacements) {
+    const content = await fs.readFile(source, { encoding: 'utf-8' })
+    return fs.writeFile(target, findReplace(content, replacements), { owner: 'inherit' })
+  }
+  return fs.copyFile(source, target, { owner: 'inherit' })
+}
+
+const copyFiles = async (targetDir, files, replacements) => {
   for (let [target, source] of Object.entries(files)) {
+    target = findReplace(join(targetDir, target), replacements)
     source = join(contentDir, source)
-    target = join(targetDir, target)
     // if the target is a subdirectory of the path, mkdirp it first
     if (dirname(target) !== targetDir) {
       await fs.mkdir(dirname(target), {
@@ -55,7 +74,7 @@ const copyFiles = async (targetDir, files) => {
         force: true,
       })
     }
-    await fs.copyFile(source, target, { owner: 'inherit' })
+    await copyFile(source, target, replacements)
   }
 }
 
@@ -94,34 +113,20 @@ const copyContent = async (path, rootPath, config) => {
 
   // only workspace now
 
-  // TODO: await copyFiles(path, workspaceFiles)
+  // TODO: await copyFiles(path, workspaceModuleFiles)
   // if we ever have workspace specific files
 
+  // transform and copy all workspace repo files
   if (config.applyWorkspaceRepoFiles) {
-    // copy and edit workspace repo file (ci github action)
     const workspacePkg = (await PackageJson.load(path)).content
-    const workspaceName = workspacePkg.name
-    let workspaceFile = `ci-${workspaceName.replace(/\//g, '-')}.yml`
-    workspaceFile = workspaceFile.replace(/@/g, '')
-    const workflowPath = join(rootPath, '.github', 'workflows')
-    await fs.mkdir(workflowPath, {
-      owner: 'inherit',
-      recursive: true,
-      force: true,
+    await copyFiles(rootPath, workspaceRepoFiles, {
+      '%%pkgname%%': workspacePkg.name,
+      '%%pkgfsname%%': workspacePkg.name.replace(/\//g, '-').replace(/@/g, ''),
+      '%%pkgpath%%': path.substring(rootPath.length + 1),
     })
-
-    let workflowData = await fs.readFile(
-      join(contentDir, './ci-workspace.yml'),
-      { encoding: 'utf-8' }
-    )
-
-    const relPath = path.substring(rootPath.length + 1)
-    workflowData = workflowData.replace(/%%pkgpath%%/g, relPath)
-    workflowData = workflowData.replace(/%%pkgname%%/g, workspaceName)
-
-    await fs.writeFile(join(workflowPath, workspaceFile), workflowData)
   }
 }
+
 copyContent.moduleFiles = moduleFiles
 copyContent.repoFiles = repoFiles
 
diff --git a/package.json b/package.json
index e7330aa6..249d1a59 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "2.8.1",
+  "version": "2.9.1",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/index.js",
   "bin": {
@@ -31,7 +31,7 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
-    "@npmcli/fs": "^1.1.1",
+    "@npmcli/fs": "^2.0.1",
     "@npmcli/map-workspaces": "^2.0.1",
     "@npmcli/package-json": "^1.0.1",
     "json-parse-even-better-errors": "^2.3.1",
@@ -45,7 +45,7 @@
     "@npmcli/eslint-config": "*",
     "@npmcli/promise-spawn": "^2.0.0",
     "@npmcli/template-oss": "file:./",
-    "eslint": "^8.9.0",
+    "eslint": "^8.10.0",
     "eslint-plugin-node": "^11.1.0",
     "tap": "*"
   },
diff --git a/test/postinstall/copy-content.js b/test/postinstall/copy-content.js
index e9e7e3a0..d80e537b 100644
--- a/test/postinstall/copy-content.js
+++ b/test/postinstall/copy-content.js
@@ -94,12 +94,18 @@ t.test('handles workspaces', async (t) => {
   await t.resolves(fs.stat(join(root, '.eslintrc.js')))
   // should have made the workspace action in the root
   await t.resolves(fs.stat(join(root, '.github', 'workflows', 'ci-amazinga.yml')))
+  await t.resolves(fs.stat(join(root, '.github', 'workflows', 'release-please-amazinga.yml')))
   await t.resolves(fs.stat(join(root, '.github', 'ISSUE_TEMPLATE', 'bug.yml')))
 
   const workspaceb = join(root, 'workspace', 'b')
   await copyContent(workspaceb, root, config)
 
-  await t.resolves(fs.stat(join(root, '.github', 'workflows', 'ci-somenamespace-amazingb.yml')))
+  const workspacebCi = join(root, '.github', 'workflows', 'ci-somenamespace-amazingb.yml')
+  await t.resolves(fs.stat(workspacebCi))
+  const workspacebCiContent = await fs.readFile(workspacebCi, { encoding: 'utf-8' })
+  t.match(workspacebCiContent, '@somenamespace/amazingb')
+  t.match(workspacebCiContent, join('workspace', 'b'))
+  t.notMatch(workspacebCiContent, '%%')
 })
 
 t.test('handles workspaces with no root repo files', async (t) => {