diff --git a/.github/helper/install.sh b/.github/helper/install.sh
index 34e777506c9..95c98b5ed20 100644
--- a/.github/helper/install.sh
+++ b/.github/helper/install.sh
@@ -4,6 +4,36 @@ set -e
 
 cd ~ || exit
 
+# Authenticate git against github.com with the job token: anonymous git-over-HTTPS from the
+# runners gets throttled to a 401, which kills whichever clone is in flight — the frappe fetch
+# below, or payments under `bench get-app`. See the PR description.
+#
+# A credential helper rather than a url.insteadOf rewrite, because `git clone` PERSISTS a
+# rewritten URL into the new repo's .git/config: an insteadOf would leave the token sitting in
+# apps/payments/.git/config on the runner. A helper is consulted only when github.com actually
+# challenges, and leaves the stored remote URL untouched. Passing it through GIT_CONFIG_* keeps
+# the token out of ~/.gitconfig too, and child processes inherit it (bench shells out to git).
+ci_github_token=${CI_GITHUB_TOKEN:-${GITHUB_TOKEN:-}}
+if [ -n "$ci_github_token" ]; then
+    export CI_GITHUB_TOKEN="$ci_github_token"
+    export GIT_CONFIG_COUNT=3
+    # Reset first: git runs EVERY configured helper and calls `store` on them after a successful
+    # auth, so a `credential.helper=store` inherited from the image's gitconfig would write the
+    # token to ~/.git-credentials. An empty value clears the list before ours is added.
+    export GIT_CONFIG_KEY_0="credential.helper"
+    export GIT_CONFIG_VALUE_0=""
+    export GIT_CONFIG_KEY_1="credential.https://github.com.username"
+    export GIT_CONFIG_VALUE_1="x-access-token"
+    export GIT_CONFIG_KEY_2="credential.https://github.com.helper"
+    # Single-quoted: $CI_GITHUB_TOKEN is expanded by the shell git runs the helper in, so the
+    # token is read from the environment at call time and never stored anywhere. Answering only
+    # `get` makes the helper inert for git's `store`/`erase` calls.
+    export GIT_CONFIG_VALUE_2='!f() { test "$1" = get && echo "password=$CI_GITHUB_TOKEN"; }; f'
+fi
+
+# Whatever happens, never sit on a credential prompt: fail fast and legibly instead.
+export GIT_TERMINAL_PROMPT=0
+
 githubbranch=${GITHUB_BASE_REF:-${GITHUB_REF##*/}}
 frappeuser=${FRAPPE_USER:-"frappe"}
 frappecommitish=${FRAPPE_BRANCH:-$githubbranch}
diff --git a/.github/workflows/patch.yml b/.github/workflows/patch.yml
index b53f9206f63..264698b9bc5 100644
--- a/.github/workflows/patch.yml
+++ b/.github/workflows/patch.yml
@@ -105,6 +105,8 @@ jobs:
         env:
           DB: mariadb
           TYPE: server
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run Patch Tests
         run: |
diff --git a/.github/workflows/run-individual-tests.yml b/.github/workflows/run-individual-tests.yml
index a70a2394757..319f62d230d 100644
--- a/.github/workflows/run-individual-tests.yml
+++ b/.github/workflows/run-individual-tests.yml
@@ -129,6 +129,8 @@ jobs:
           TYPE: server
           FRAPPE_USER: ${{ github.event.inputs.user }}
           FRAPPE_BRANCH: ${{ github.event.inputs.branch }}
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
 
       - name: Run Tests
         run: |
diff --git a/.github/workflows/server-tests-mariadb.yml b/.github/workflows/server-tests-mariadb.yml
index c55c3f501f3..36ec44563b0 100644
--- a/.github/workflows/server-tests-mariadb.yml
+++ b/.github/workflows/server-tests-mariadb.yml
@@ -102,6 +102,8 @@ jobs:
           TYPE: server
           FRAPPE_USER: ${{ github.event.inputs.user }}
           FRAPPE_BRANCH: ${{ github.event.client_payload.sha || github.event.inputs.branch }}
+          # Anonymous git to github.com gets throttled to a 401; authenticate the clones.
+          CI_GITHUB_TOKEN: ${{ github.token }}
           DB_HOST: 127.0.0.1
           DB_USER_HOST: '%'
           WKHTMLTOX_DEB: /tmp/wkhtmltox.deb