diff --git a/.github/workflows/release-node-playwright.yaml b/.github/workflows/release-node-playwright.yaml
index 1062b1ab..2aa8106e 100644
--- a/.github/workflows/release-node-playwright.yaml
+++ b/.github/workflows/release-node-playwright.yaml
@@ -240,6 +240,8 @@ jobs:
           tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
           cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
           cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
       - name: Test image
         run: docker run ${{ fromJson(steps.prepare-tags.outputs.result).firstImageName }}
@@ -281,6 +283,8 @@ jobs:
             type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
             type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
           cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
       - name: Test slim image
         run: docker run ${{ fromJson(steps.prepare-slim-tags.outputs.result).firstImageName }}
@@ -351,6 +355,8 @@ jobs:
           tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
           outputs: type=image,oci-mediatypes=true
           cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push slim OCI image
         if: github.event_name != 'pull_request'
@@ -370,6 +376,8 @@ jobs:
           cache-from: |
             type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
             type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
   # Aggregate the per-image size reports uploaded by the build matrix and post/update
   # a single sticky PR comment comparing current vs new image sizes.
diff --git a/.github/workflows/release-python-playwright.yaml b/.github/workflows/release-python-playwright.yaml
index 18f7ec74..f00433be 100644
--- a/.github/workflows/release-python-playwright.yaml
+++ b/.github/workflows/release-python-playwright.yaml
@@ -183,6 +183,8 @@ jobs:
           tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
           cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
           cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
       - name: Test image
         run: docker run ${{ fromJson(steps.prepare-tags.outputs.result).firstImageName }}
@@ -245,6 +247,8 @@ jobs:
           tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
           outputs: type=image,oci-mediatypes=true
           cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
+          secrets: |
+            github_token=${{ secrets.GITHUB_TOKEN }}
 
   # Aggregate the per-image size reports uploaded by the build matrix and post/update
   # a single sticky PR comment comparing current vs new image sizes.
diff --git a/node-playwright-camoufox/Dockerfile b/node-playwright-camoufox/Dockerfile
index 6a6b4089..d07eb1c1 100644
--- a/node-playwright-camoufox/Dockerfile
+++ b/node-playwright-camoufox/Dockerfile
@@ -135,9 +135,17 @@ ARG SLIM=0
 RUN if [ "$SLIM" = "1" ]; then mv package.slim.json package.json; else rm package.slim.json; fi
 
 # Install default dependencies, print versions of everything
-RUN npm --quiet set progress=false \
+#
+# GITHUB_TOKEN raises the api.github.com rate limit for `camoufox-js fetch`. A secret, not a build
+# arg, keeps it out of the layers; mode=0444 because this stage runs as myuser. Optional.
+RUN --mount=type=secret,id=github_token,mode=0444 \
+    npm --quiet set progress=false \
     \
     # Install Camoufox browser
+    && if [ -r /run/secrets/github_token ]; then \
+           GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+           export GITHUB_TOKEN; \
+       fi \
     && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 npx camoufox-js fetch \
     # Overrides the dynamic library used by Firefox to determine trusted root certificates with p11-kit-trust.so, which loads the system certificates.
     && rm -f /home/myuser/.cache/camoufox/libnssckbi.so \
diff --git a/python-playwright-camoufox/Dockerfile b/python-playwright-camoufox/Dockerfile
index 2222db6e..deaa499f 100644
--- a/python-playwright-camoufox/Dockerfile
+++ b/python-playwright-camoufox/Dockerfile
@@ -103,14 +103,25 @@ ENV PATH="/root/.local/bin:/home/myuser/.local/bin:$PATH"
 # - Preinstalls the latest versions of setuptools and wheel to improve package installation speed
 # - Installs the specified version of Playwright and Camoufox
 # - Fetches the Camoufox browser
-RUN python -m pip install --upgrade \
+#
+# GITHUB_TOKEN raises the api.github.com rate limit for `camoufox fetch`. A secret, not a build
+# arg, keeps it out of the layers. Optional.
+RUN --mount=type=secret,id=github_token \
+    python -m pip install --upgrade \
     pip \
     setuptools \
     wheel \
     playwright~=${PLAYWRIGHT_VERSION} \
     camoufox[geoip]~=${CAMOUFOX_VERSION} \
     # Fetch the Camoufox browser
+    && if [ -r /run/secrets/github_token ]; then \
+           GITHUB_TOKEN="$(cat /run/secrets/github_token)"; \
+           export GITHUB_TOKEN; \
+       fi \
     && python -m camoufox fetch \
+    # `camoufox fetch` swallows sync errors and exits 0, so check what the runtime checks
+    # rather than ship an image that only fails at launch.
+    && python -c "from camoufox.pkgman import installed_verstr; print('Camoufox installed:', installed_verstr())" \
     # Overrides the dynamic library used by Firefox to determine trusted root certificates with p11-kit-trust.so, which loads the system certificates.
     && rm -f /root/.cache/camoufox/libnssckbi.so \
     && ln -s /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /root/.cache/camoufox/libnssckbi.so