diff --git a/.kamal/secrets.beta b/.kamal/secrets.beta
index bc94c7d12..3595d48da 100644
--- a/.kamal/secrets.beta
+++ b/.kamal/secrets.beta
@@ -1,4 +1,5 @@
 SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/REGISTRY_PASSWORD Beta/SECRET_KEY_BASE)
 
+GITHUB_TOKEN=$(gh config get -h github.com oauth_token)
 KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract REGISTRY_PASSWORD $SECRETS)
 SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS)
diff --git a/.kamal/secrets.production b/.kamal/secrets.production
index 457427997..ef8f34665 100644
--- a/.kamal/secrets.production
+++ b/.kamal/secrets.production
@@ -1,4 +1,5 @@
 SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/REGISTRY_PASSWORD Production/SECRET_KEY_BASE)
 
+GITHUB_TOKEN=$(gh config get -h github.com oauth_token)
 KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract REGISTRY_PASSWORD $SECRETS)
 SECRET_KEY_BASE=$(kamal secrets extract SECRET_KEY_BASE $SECRETS)
diff --git a/Dockerfile b/Dockerfile
index 4f7cc13a2..c0051724d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,8 @@ RUN apt-get update -qq && \
 
 # Install application gems
 COPY Gemfile Gemfile.lock .ruby-version ./
-RUN bundle install && \
+RUN --mount=type=secret,id=GITHUB_TOKEN \
+    BUNDLE_GITHUB__COM="$(cat /run/secrets/GITHUB_TOKEN):x-oauth-basic" bundle install && \
     rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
     bundle exec bootsnap precompile --gemfile
 
diff --git a/config/deploy.yml b/config/deploy.yml
index bde2155d6..43950fd9f 100644
--- a/config/deploy.yml
+++ b/config/deploy.yml
@@ -19,6 +19,8 @@ registry:
 
 builder:
   arch: amd64
+  secrets:
+    - GITHUB_TOKEN
 
 env:
   secret: