diff --git a/.github/workflows/build_release.yml b/.github/workflows/build_release.yml
index fa3076bc..0dd8c97a 100644
--- a/.github/workflows/build_release.yml
+++ b/.github/workflows/build_release.yml
@@ -196,23 +196,22 @@ jobs:
 
       - name: "Build flatpak: download only"
         id: flatpak-download
-        run: |
-          git config --global credential.helper store
-          echo "https://${{ steps.generate-rekku-token.outputs.token }}@github.com" > ~/.git-credentials
-          "${GITHUB_WORKSPACE}/automation_tools/flatpak_build_download_only.sh"
+        run: "/bin/bash ${GITHUB_WORKSPACE}/automation_tools/flatpak_build_download_only.sh"
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-rekku-token.outputs.token }}
 
       # Sometimes flatpak download fails, in this case it tries a second time
       - name: "Build flatpak: download only (retry)"
         if: steps.flatpak-download.outcome == 'failure'
         run: |
-          git config --global credential.helper store
-          echo "https://${{ steps.generate-rekku-token.outputs.token }}@github.com" > ~/.git-credentials
           echo "Download failed, maybe some hash changed since the build start."
           echo "Recalculating hashes and retrying download..."
           rm -f "{GITHUB_WORKSPACE}/net.retrodeck.retrodeck.yml"
           cp "${GITHUB_WORKSPACE}/net.retrodeck.retrodeck.yml.bak" "${GITHUB_WORKSPACE}/net.retrodeck.retrodeck.yml"
           "${GITHUB_WORKSPACE}/automation_tools/pre_build_automation.sh"
           "${GITHUB_WORKSPACE}/automation_tools/flatpak_build_download_only.sh"
+        env:
+          GITHUB_TOKEN: ${{ steps.generate-rekku-token.outputs.token }}
 
       - name: Build flatpak
         run: "/bin/bash ${GITHUB_WORKSPACE}/automation_tools/flatpak_build_only.sh"
diff --git a/automation_tools/flatpak_build_download_only.sh b/automation_tools/flatpak_build_download_only.sh
index e8fca807..158f9af1 100755
--- a/automation_tools/flatpak_build_download_only.sh
+++ b/automation_tools/flatpak_build_download_only.sh
@@ -4,6 +4,16 @@
 
 git config --global protocol.file.allow always
 
+# Getting token from env
+TOKEN=$GITHUB_TOKEN
+
+export GIT_CURL_VERBOSE=1
+export GIT_ASKPASS=echo
+export GIT_USERNAME=token
+export GIT_PASSWORD=$TOKEN
+
+sed -i "s|Authorization: token .*|Authorization: token ${TOKEN}|" "${GITHUB_WORKSPACE}/net.retrodeck.retrodeck.yml"
+
 if [[ "${GITHUB_REF##*/}" == "main" ]]; then
     BUNDLE_NAME="RetroDECK.flatpak"
     FOLDER=retrodeck-flatpak
diff --git a/net.retrodeck.retrodeck.yml b/net.retrodeck.retrodeck.yml
index 94d6f5a0..d051ec3e 100644
--- a/net.retrodeck.retrodeck.yml
+++ b/net.retrodeck.retrodeck.yml
@@ -570,9 +570,11 @@ modules:
       - mkdir -p "${FLATPAK_DEST}/retrodeck/licenses"
       - mv LICENSE.txt "${FLATPAK_DEST}/retrodeck/licenses"
     sources:
-      - type: file
+      - type: archive
         url: https://github.com/RetroDECK/Pancakes/releases/download/1.1.0.1403/pancakes-Release-linux_x64.tar.gz
         sha256: cc7d25b6a2f2ad16533e3d72ba9477a4d77b8cfbb450f0db3d0c05ffde5e1281
+        x-extra-headers:
+          - "Authorization: token ${GITHUB_TOKEN}"
 
   # XEMU
   # https://xemu.app/docs/download/#download-for-linux