diff --git a/scripts/install-arm-ttk.sh b/scripts/install-arm-ttk.sh
index 7dabcf6f..09d104fa 100755
--- a/scripts/install-arm-ttk.sh
+++ b/scripts/install-arm-ttk.sh
@@ -8,12 +8,12 @@ set -euo pipefail
 
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   https://api.github.com/repos/Azure/arm-ttk/releases/latest | jq -r '.tarball_url')
 mkdir -p /usr/lib/microsoft
 curl --retry 5 --retry-delay 5 -sL \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}" | tar -xz -C /usr/lib/microsoft
 mv /usr/lib/microsoft/Azure-arm-ttk-*/arm-ttk /usr/lib/microsoft/arm-ttk
 rm -rf /usr/lib/microsoft/Azure-arm-ttk-*
diff --git a/scripts/install-kubeval.sh b/scripts/install-kubeval.sh
index 5ce2cec4..c7ef0705 100755
--- a/scripts/install-kubeval.sh
+++ b/scripts/install-kubeval.sh
@@ -4,12 +4,12 @@ set -euo pipefail
 
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/instrumenta/kubeval/releases/tags/${KUBEVAL_VERSION}" |
   jq -r '.assets | .[] | select(.name | contains("linux-amd")) | .url')
 curl --retry 5 --retry-delay 5 -sL \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}" | tar -xz
 mv kubeval /usr/local/bin
 
@@ -18,12 +18,12 @@ mv kubeval /usr/local/bin
 ##################
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/pinterest/ktlint/releases/tags/${KTLINT_VERSION}" |
   jq -r '.assets | .[] | select(.name=="ktlint") | .url')
 curl --retry 5 --retry-delay 5 -sL -o "/usr/bin/ktlint" \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}"
 chmod a+x /usr/bin/ktlint
 terrascan init
@@ -34,12 +34,12 @@ cd ~ && touch .chktexrc
 ####################
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/sgerrand/alpine-pkg-glibc/releases/tags/${GLIBC_VERSION}" |
   jq --arg name "glibc-${GLIBC_VERSION}.apk" -r '.assets | .[] | select(.name | contains($name)) | .url')
 curl --retry 5 --retry-delay 5 -sL -o "glibc-${GLIBC_VERSION}.apk" \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}"
 apk add --no-cache "glibc-${GLIBC_VERSION}.apk"
 rm "glibc-${GLIBC_VERSION}.apk"
diff --git a/scripts/install-phive.sh b/scripts/install-phive.sh
index 0c265560..e89dd7e6 100755
--- a/scripts/install-phive.sh
+++ b/scripts/install-phive.sh
@@ -6,12 +6,12 @@ set -x
 apk add curl jq
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/sgerrand/alpine-pkg-glibc/releases/tags/${GLIBC_VERSION}" |
   jq --arg name "glibc-${GLIBC_VERSION}.apk" -r '.assets | .[] | select(.name | contains($name)) | .url')
 curl --retry 5 --retry-delay 5 -sL -o "glibc-${GLIBC_VERSION}.apk" \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}"
 apk add --no-cache \
   bash \
diff --git a/scripts/install-pwsh.sh b/scripts/install-pwsh.sh
index 0e35b754..41a2f127 100755
--- a/scripts/install-pwsh.sh
+++ b/scripts/install-pwsh.sh
@@ -9,12 +9,12 @@ set -euo pipefail
 mkdir -p "${PWSH_DIRECTORY}"
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/powershell/powershell/releases/${PWSH_VERSION}" |
   jq -r '.assets | .[] | select(.name | contains("linux-alpine-x64")) | .url')
 curl --retry 5 --retry-delay 5 -sL \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}" | tar -xz -C "${PWSH_DIRECTORY}"
 chmod +x "${PWSH_DIRECTORY}/pwsh"
 ln -sf "${PWSH_DIRECTORY}/pwsh" /usr/bin/pwsh
diff --git a/scripts/install-raku.sh b/scripts/install-raku.sh
index 2f4e3e47..90503aa3 100755
--- a/scripts/install-raku.sh
+++ b/scripts/install-raku.sh
@@ -9,12 +9,12 @@ apk add --no-cache rakudo zef
 ######################
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/checkstyle/checkstyle/releases/tags/checkstyle-${CHECKSTYLE_VERSION}" |
   jq --arg name "checkstyle-${CHECKSTYLE_VERSION}-all.jar" -r '.assets | .[] | select(.name==$name) | .url')
 curl --retry 5 --retry-delay 5 -sL -o /usr/bin/checkstyle \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}"
 chmod a+x /usr/bin/checkstyle
 
@@ -23,12 +23,12 @@ chmod a+x /usr/bin/checkstyle
 ##############################
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "https://api.github.com/repos/google/google-java-format/releases/tags/v${GOOGLE_JAVA_FORMAT_VERSION}" |
   jq --arg name "google-java-format-${GOOGLE_JAVA_FORMAT_VERSION}-all-deps.jar" -r '.assets | .[] | select(.name==$name) | .url')
 curl --retry 5 --retry-delay 5 -sL -o /usr/bin/google-java-format \
   -H "Accept: application/octet-stream" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}"
 chmod a+x /usr/bin/google-java-format
 
@@ -43,11 +43,11 @@ cd .. && rm -r lua-5.3.5/
 
 url=$(curl -s \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   https://api.github.com/repos/cvega/luarocks/releases/latest | jq -r '.tarball_url')
 curl --retry 5 --retry-delay 5 -sL \
   -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+  -H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \
   "${url}" | tar -xz
 cd cvega-luarocks-6b1aee6
 ./configure --with-lua-include=/usr/local/include