diff --git a/.github/workflows/build-teensy-loader-cli/action.yml b/.github/workflows/build-teensy-loader-cli/action.yml
index a9f8ed1..c34b6a0 100644
--- a/.github/workflows/build-teensy-loader-cli/action.yml
+++ b/.github/workflows/build-teensy-loader-cli/action.yml
@@ -15,6 +15,9 @@ inputs:
     description: The filepath of the resulting executable
     required: false
     default: "./teensy_loader_cli.exe"
+  token:
+    description: secret token required to checkout an external repository
+    required: true
 
 outputs:
   binary-path:
@@ -34,7 +37,7 @@ runs:
         repository: PaulStoffregen/teensy_loader_cli
         ref: ${{ inputs.version }}
         path: ${{ inputs.local_source_path }}
-        token: ${{ secrets.TEENSY_LOADER_CLI_SOURCE_PAT }}
+        token: ${{ inputs.token }}
       
     - shell: bash
       name: Fix broken include paths for windows
diff --git a/.github/workflows/publish-app.yml b/.github/workflows/publish-app.yml
index 5dab651..9050040 100644
--- a/.github/workflows/publish-app.yml
+++ b/.github/workflows/publish-app.yml
@@ -45,6 +45,8 @@ jobs:
       - name: Build Teensy Loader CLI
         id: build-step
         uses: ./.github/workflows/build-teensy-loader-cli
+        with:
+          token: ${{ secrets.TEENSY_LOADER_CLI_SOURCE_PAT }}
       - name: Store Teensy loader cli binary as asset
         uses: actions/upload-artifact@v2
         with: