diff --git a/.github/actions/setup-haxe/action.yml b/.github/actions/setup-haxe/action.yml
index dd0a3a59d..05641764e 100644
--- a/.github/actions/setup-haxe/action.yml
+++ b/.github/actions/setup-haxe/action.yml
@@ -17,6 +17,8 @@ inputs:
   targets:
     description: 'Targets we plan to compile to. Installs native dependencies needed.'
     required: true
+  gh-token:
+    description: 'GitHub secret for private repos as dependencies'
 
 runs:
   using: "composite"
@@ -73,8 +75,19 @@ runs:
     name: Install dependencies
     shell: bash
     run: |
+      key="credential.https://github.com"
       git config --list --show-origin --show-scope
+      if [ ! -z "${{ inputs.gh-token }}" ]; then
+        git config --global "credential.helper" 'cache --timeout=3600'
+        git config --global "$key.username" "git"
+        git config --global "$key.password" "${{ inputs.gh-token }}"
+      fi
       haxelib --debug --global run hmm install
+      if [ ! -z "${{ inputs.gh-token }}" ]; then
+        git config --global --unset "credential.helper"
+        git config --global --unset "$key.username"
+        git config --global --unset "$key.password"
+      fi
       echo "TIMER_DONE=$(date +%s)" >> "$GITHUB_ENV"
 
   # by default use a shared hxcpp cache
diff --git a/.github/workflows/build-game.yml b/.github/workflows/build-game.yml
index 599275e84..4d72dc036 100644
--- a/.github/workflows/build-game.yml
+++ b/.github/workflows/build-game.yml
@@ -42,6 +42,8 @@ jobs:
 
     - name: Setup build environment
       uses: ./.github/actions/setup-haxe
+      with:
+        gh-token: ${{ steps.app_token.outputs.token }}
 
     - name: Build game
       if: ${{ matrix.target == 'windows' }}
@@ -102,9 +104,15 @@ jobs:
     - if: ${{ steps.cache-hmm.outputs.cache-hit != 'true' }}
       name: Install dependencies
       run: |
-        git config --global url.https://${{ steps.app_token.outputs.token }}@github.com/.insteadOf https://github.com/
+        key="credential.https://github.com"
+        git config --global "credential.helper" 'cache --timeout=3600'
+        git config --global "$key.username" "git"
+        git config --global "$key.password" "${{ steps.app_token.outputs.token }}"
         haxelib --debug git funkVis https://github.com/FunkinCrew/funkVis backend-rework
         haxelib --global run hmm install -q
+        git config --global --unset "credential.helper"
+        git config --global --unset "$key.username"
+        git config --global --unset "$key.password"
 
     - if: ${{ matrix.target != 'html5' }}
       name: Restore hxcpp cache