diff --git a/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts b/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
index 6f401eee..096104a9 100644
--- a/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
+++ b/scripts/src/platform-infra-pipelines-as-code-source-artifact.ts
@@ -76,6 +76,8 @@ export interface PacSourceArtifactBinding {
     readonly cloneUrl: string;
     readonly owner: string;
     readonly repo: string;
+    readonly secretName: string;
+    readonly tokenKey: string;
     readonly params: Readonly<Record<string, string>>;
   };
 }
diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts
index cea7b696..ab4b560e 100644
--- a/scripts/src/platform-infra-pipelines-as-code.ts
+++ b/scripts/src/platform-infra-pipelines-as-code.ts
@@ -420,6 +420,8 @@ export async function runPlatformInfraPipelinesAsCodeCommand(config: UniDeskConf
           cloneUrl: repository.cloneUrl,
           owner: repository.owner,
           repo: repository.repo,
+          secretName: repository.secretName,
+          tokenKey: repository.tokenKey,
           params: consumerParams(repository, consumer),
         },
       };
diff --git a/scripts/src/platform-infra-static-site-pipeline.ts b/scripts/src/platform-infra-static-site-pipeline.ts
index 7059aae1..02ae7d67 100644
--- a/scripts/src/platform-infra-static-site-pipeline.ts
+++ b/scripts/src/platform-infra-static-site-pipeline.ts
@@ -153,7 +153,16 @@ function renderPipeline(config: StaticSiteConfig, target: StaticSiteTarget, bind
       params,
       workspaces: [{ name: "source" }],
       tasks: [
-        task("source-validate", [{ name: "checkout-and-site-check", image: "$(params.tools-image)", imagePullPolicy: "IfNotPresent", env: proxyEnv(), script: sourceValidateScript() }]),
+        task("source-validate", [{
+          name: "checkout-and-site-check",
+          image: "$(params.tools-image)",
+          imagePullPolicy: "IfNotPresent",
+          env: [
+            ...proxyEnv(),
+            { name: "GITEA_TOKEN", valueFrom: { secretKeyRef: { name: binding.repository.secretName, key: binding.repository.tokenKey } } },
+          ],
+          script: sourceValidateScript(),
+        }]),
         task("image-build", [{
           name: "build-and-push",
           image: "$(params.buildkit-image)",
@@ -184,6 +193,20 @@ function sourceValidateScript(): string {
     "set -eu",
     "root=\"$(workspaces.source.path)\"",
     "rm -rf \"$root/repo\"",
+    "askpass=/tmp/hwpod-home-source-git-askpass",
+    "trap 'rm -f \"$askpass\"' 0 1 2 15",
+    "cat >\"$askpass\" <<'ASKPASS'",
+    "#!/bin/sh",
+    "case \"$1\" in",
+    "  *Username*) printf '%s' x-access-token ;;",
+    "  *Password*) printf '%s' \"$GITEA_TOKEN\" ;;",
+    "  *) exit 1 ;;",
+    "esac",
+    "ASKPASS",
+    "chmod 700 \"$askpass\"",
+    "export GIT_ASKPASS=\"$askpass\"",
+    "export GIT_TERMINAL_PROMPT=0",
+    "test -n \"$GITEA_TOKEN\"",
     "git clone --filter=blob:none --no-checkout \"$(params.git-read-url)\" \"$root/repo\"",
     "cd \"$root/repo\"",
     "git fetch --depth=1 --filter=blob:none origin \"+$(params.source-stage-ref):refs/remotes/origin/hwpod-home-source-snapshot\"",
@@ -192,6 +215,8 @@ function sourceValidateScript(): string {
     "node scripts/check.mjs",
     "test -f config/hwpod-home.yaml",
     "chmod -R a+rX,g+rwX \"$root/repo\"",
+    "rm -f \"$askpass\"",
+    "trap - 0 1 2 15",
     "printf '{\"ok\":true,\"phase\":\"source-validate\",\"sourceCommit\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\"",
   ].join("\n");
 }